Verify that the type of request is appropriate. Only allow identity requests and access requests. Determine
that the request comes from a valid source. If the request is for a more specialized type of request, verify that it
comes from a trusted source.