This "Healthcare Partnerships" pattern seems like what you would need https://www.medplum.com/docs/access/access-policies#healthcare-partnerships

Then meta.account should be an array of References, right? According to the documentation meta.account can only contain a single Reference.