We're using Medplum as the application database for a set of products delivered via a single UI. I'm trying to determine how to use AccessPolicy resources in a sensible way to control what data the user is able to view/edit in each of the products they are able to use. We determine that a user has access to a product via groups and attributes supplied by our customers' identity providers. I'm wondering if I can create a hierarchy of AccessPolicy resources with some notion of inheritance. The idea would be to have a base AccessPolicy that describes the most basic type of access, and then to compose more detailed AccessPolicy resources that inherit access from their parent and then add (e.g., a new type of resource) or update (e.g., giving write permission instead of readonly) the access. In the documentation, I haven't really seen anything related to this kind of idea. I've noted that in the Medplum app there's a notion of adding a "based on" reference when creating an AccessPoliy, but I don't see that notion in the relevant documentation for the AccessPolicy resource type: https://www.medplum.com/docs/api/fhir/medplum/accesspolicy Any recommendations on how to approach this?

Will this work for you? https://www.medplum.com/docs/access/access-policies#parameterized-policies