Because access controls have legal context, we sometimes need signed verification of their creation. In the onboarding process, the highest level description of what happens is that we create `UPDATE_ONLY` access controls for providers, and the documents are an essential part of that.