Good afternoon everyone, I would like some support regarding the access policy. I will explain the test I did and the result I expect. Firstly, I created a Client, called ImunizaGoias, within the project we have. Soon after, I created an AccessPolicy with Patient, ReadOnly. Finally, I linked AccesPolicy in the ImunizaGoias Client. When executing the command https://fhir-api.saude.go.gov.br/Immunization?_format=json&_count=1 I can return instances of Immunization. According to AcessPolicy (Patient ReadOnly) shouldn't access be prohibited? I am attaching all the images to the message, The ImunizaGoias Client, the AccessPolicy only with Patient ReadOnly and the AccessPolicy link within the Client. Thank you in advance for your help!

@Adriano Freitas , this could be an issue with how you're authenticating. How are you getting access tokens for executing this command? https://fhir-api.saude.go.gov.br/Immunization?_format=json&_count=1

Sorry for the delay! Well, I got the ID and Secret of the ClientApplication that I created for ImunizaGoias. Then, I submit it to the URL https://api-fhir-homolog.saude.go.gov.br/oauth2/token and receive the Token. Once you receive the token, configure it in a POSTMAN call for Endpoint consumption. The function I use to retrieve the token is in Python, the code is as follows: def get_auth_token(url, client_id, client_secret): authorization = b64.b64encode(f"{client_id}:{client_secret}".encode()).decode("ascii") headers = { "Authorization": f"Basic {authorization}", "Content-Type": "application/x-www-form-urlencoded" } body = { "grant_type": "client_credentials" } response = requests.post(url, data=body, headers=headers, verify=False) return response.json()['access_token']

@Adriano Freitas sorry for the delay. based on what you've described, I wuld expect ths to be working. One thing to check is to make a call, with this token, to

[baseUrl]/auth/me

. This should return: 1. The ProjectMembership used for login 2. The derived access policy for the current user

Can you help me understand and configure it the way I need it? I thought that to control access to resources, it was enough to create a Client and link it to an Access Policy. That's enough? Or do I need to create another Project? Can you help me with how the hierarchy works? I need to create a Client or API access service that can only read Patient type resources. Can you help me? As the message is very large, I will attach the command response file here for evaluation. (see attached file)

@Adriano Freitas - the issue is that you are using the "Super Admin" project. At this time, the Super Admin project bypasses Access policy checks

Thank you very much @rahul1 ! Regarding this Super Admin project, I loaded all the instances for it, unfortunately. I thought about doing the following: I'm going to create a new project, put it as Super Admin and include the Administrator user. This project that already has instances, I will remove the Super Admin marking from it and include users to generate Workflows and create instances. Do you think it could be like that?

I've never tried that myself, but I think that might work

Thank you @rahul1 ! It worked!