Maybe the naming is sort of backwards, but the process "authorizes" providers by creating an access control for the record (and then the residual documents). But the crux of it is the access control, I think, which we might actually need for any access control. 

Since the signature is meant to represent only their "intention to sign," I'm not sure it has to exactly match their name. We could easily put a validation at the top of the controller method, but I'm not sure that's a legal requirement. Some might want to put their middle initial, for instance.