An approval is security state, not session state — NullRun