Open this from the Face ID button on an approval card.
Deny from the card itself — denying never needs Face ID. This page only carries your answer; the host verifies it.