A couple options: "no access policy" effectively means access to all resources. When getting started, that's usually what providers want .
If you want to restrict providers to only certain resources, then you could do something like this:
https://gist.github.com/codyebberson/7b686db96dcab114c207f3a2e312cd90
If you want to restrict providers to only their patients or their panel, then the access policy will be more customized to your organization. We're working on some docs that describe best practices that we have observed. Or we'd be happy to jump on a call to discuss.