That's mostly accurate. Medplum intentionally does not want to be too opinionated about workflow, and therefore contains very little "business logic". Bots are the primary way to drive workflow logic such as "if this then that" style rules. You could say that Medplum "Access Policies" / access controls drive some logic. For example, controlling which users have access to which resources under which circumstances. That can be by status, etc. Of course, bots are not required. You can drive workflow and logic through the API from other tools and services as well.