  Additional requirements: - when we change IS, we'll need to fetch its policy docs and capture that the user has agreed to them - we should probably also validate that it's really an IS - we should _also_ somehow validate that the HS permits access to this IS if it maintains a whitelist...