* guard 1: Validate workhorse rewritten_fields before using them
* guard 2: In UploadedFile, if a remote_id is given, it takes priority
           over a file path.
* guard 3: When possible use the values passed through the JWT header
           instead of reading the body params.