Updated documentation on Parameterized Access Policies is available - this supports many sophisticated scenarios https://www.medplum.com/docs/auth/access-control#parameterized-policies-beta There's also a demo video that illustrates some of the principles: