When API key has changed origin, actions complete even if the performer does not have access to the reference item

Description

When API key has Performed origin changed, approvals from reference items not available to the performer are still retrieved without issues (GET method) and the other actions (POST, PATCH, DELETE methods) on such approvals do not throw any errors.

Expected behaviour:

  1. An approval on a reference the performer cannot see is not included in the GET /approvals response.

  2. Actions like create/archive/delete are not completed and the outcome is surfaced as an instance warning.