For example, I'd like to restrict certain Location to be accessed by one specific Practitioner, can I add a reference to the Practitioner in the extension field and set with a parameterized access policy? Thank you 🙏

@s_w_abc you're right that we don't allow searches / access policy criteria over extensions. As noted here, we follow a subset of the FHIR search spec (https://www.medplum.com/docs/access/access-policies#criteria-based-access-control)

Thanks for replying, @rahul1 ! happy to walk through our use case. We have multiple practitioners that restricted from accessing other practitioners' resources. e.g. one practitioner maintains a certain group of patients, and this practitioner is not allowed to see other patients' data. How do we add access policy to Location, Observation resources etc. that doesn't have direct reference to the practitioner?

Hi @s_w_abc , in general the right way to go would be to use parameterized access policies and use the patient compartment, as described in this example: https://www.medplum.com/docs/access/access-policies#patient-access