Hi Pieter,

You're correct there is no authentication for Forms Direct Approval via Email. Forms constructs massive unique strings for the action button links, which are associated with the task assignee. It's assumed that the Direct Approval email is going to the correct email address of the person assigned the task. 

This is conceptually similar to the default auth setting ("Not Required to Login") for DocuSign signing requests:

Once you select the documents to send, you can add up to 99 recipients who will receive and sign your documents or receive a copy. You provide an email address and name for each recipient. Recipients don't need a DocuSign account to open your document and complete their signing action.

Accordingly, if you require stricter controls on approver attribution, either (a) take extra care to validate that in Production you're always sending Direct Approval emails to the correct individual's email address (especially do not send Direct Approval emails to shared inboxes), or (b) do not use the feature.

The current documentation on Direct Approval via Email does not adequately describe security/authentication/auditing considerations. We'll at minimum get that updated so people have the information they need to make an informed decision about using the feature.