Approvals are based on assertions. Receipt or generation of an assertion will interact with organizational authentication and authorization policies. For example, an approval may be received by mistake as part of the transfer of a patient record.