A FHIR server may legally ignore the provenance header meant to prove who wrote an entry, a granted write scope only confirms a ceiling on what an agent might do and not what a server will accept, and neither settles whether the agent doing the writing has built a medical device.