Hi, I’m currently working on configuring access policies, and I’m encountering some difficulties. Here is the current access policy:

json
{
  "resourceType": "AccessPolicy",
  "name": "Patient Access Policy Template",
  "compartment": {
    "reference": "%patient"
  },
  "resource": [
    {
      "resourceType": "ServiceRequest",
      "criteria": "ServiceRequest?_compartment=%patient"
    },
    {
      "resourceType": "Procedure",
      "criteria": "Procedure?_compartment=%patient"
    },
    {
      "resourceType": "Device",
      "criteria": "Device?_id=%device"
    }
  ]
}

Additionally, the

ProjectMembership

looks like this:

json
{
  "resourceType": "ProjectMembership",
  "profile": {
    "reference": "Patient/1c31cfce-aec0-43f4-8ec6-49a64ceffb57",
    "display": "Manon Nomand"
  },
  "id": "16e7990f-f91e-46bc-8b99-25c14483cf75",
  "accessPolicy": {
    "reference": "AccessPolicy/c2357ecb-1a44-41df-ada1-6a7ec8941df4",
    "display": "Patient Access Policy Template"
  },
  "access": [
    {
      "policy": {
        "reference": "AccessPolicy/c2357ecb-1a44-41df-ada1-6a7ec8941df4"
      },
      "parameter": [
        {
          "name": "device",
          "valueReference": {
            "reference": "96bdf1de-6771-4ee6-8890-703c912ecc14,ef539b32-0703-41da-b640-e28477d098b5"
          }
        }
      ]
    }
  ]
}

Currently, I’m able to access the

Device

resources related to the patient, but I’m unable to create a new

Device

resource. In my use case: - A patient should be able to create a new

Device

resource. - The patient should only be able to read

Device

resources that they are associated with through the parameterized access. Is there a way to define a write-only condition that I can add to my access policy for device creation? Or should I modify the current policy to include specific write permissions? What is the best approach for achieving this? Thank you in advance for your help!