@startuml impersonate
start

if (The request has bearer token with allow_impersonate=true?) then (yes)
	:Treat bearer token issuer as the request owner.;
	end
(no) elseif (The request has session token?) then (yes)
	:Treat session token issuer as the request owner.;
	end
else (no)
	:Determine request owner from the request signature.;
	end
endif

@enduml