Approve or decline

The workspace and user come from the session, never from the request body. That is what makes it impossible for a client to obtain a grant on an account other than the one whose owner is looking at the screen.

Approval mints a single-use authorization code and returns the URL for the browser to follow; declining returns the same URL carrying access_denied. A declined request is spent, so re-opening the consent URL cannot resume it.