Hi @sara_31357 , following this documentation page https://www.medplum.com/docs/access/access-policies it seems to me you are on the right path. You could think of AccessPolicy resource as a specific security role. I wonder what did not reach your expectations with AccessPolicies? Also I am sure @rahul1 has more insights