* Access Token Allows Creating Observations for Other Patients?* Hi Medplum Team, I hope you doing well! I’m having an issue with my setup and could use your help. I am using self-hosted Medplum for testing. I’ve set up an Access Policy to restrict users to their own patient compartments. { "resourceType": "AccessPolicy", "name": "AccessPolicy", "id": "1f7e7685-960e-48d2-8dcb-2bb097f258fe", "compartment": { "reference": "%patient" }, "resource": [ { "resourceType": "Patient", "criteria": "Patient?_compartment=%patient" }, { "resourceType": "Observation", "criteria": "Observation?_compartment=%patient" }, ..... I obtain Exchanging Token for Medplum Token: jwt_token = generate_jwt_token({"email": email}) # Exchange the JWT token for a Medplum access token token_url = f"{MEDPLUM_URL}/oauth2/token" client_id = MEDPLUM_CLIENT_ID client_secret = MEDPLUM_CLIENT_SECRET exchange_data = { "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", "subject_token_type": "urn:ietf:params:oauth:token-type:access_token", "subject_token": jwt_token, "client_id": client_id, "client_secret": client_secret, "redirect_uri": REDIRECT_URI, "scope": "openid offline patient/*.read patient/*.write", } The Access Tokens has patient/Patient.read and patient/Patient.write scopes for each user. However, I’ve noticed that I’m still able to create Observation resources for different patients, not just the one the token is supposed to be limited to. e.g. on payload to /fhir/R4/Observation, I can change Subject reference to other Patient ID (author meta has patient id)