Hello @MedPlum team, We are implementing the following functionality in MedPlum, - We Create a specific Organization and patients are linked to this specific Organization. - The Registered users need to be grouped together in a specific group that is under that organization having a specific set of goals that each user needs to achieve on a daily basis. - When the Admin Type of user logs in to the app he should have access to all the groups under his/her Organization and able to connect all the users under Organization along with the group. - Also, the admin should be able to move the user from one group to another and promote any of them to admin type if needed - A super admin can access data from all organizations. Our Implementation approach - We creating different projects which refer to an Organization in our terminology, and manage access control at the project level. This ensures that data from one project is isolated from the organization admin of another project. However, we're exploring an alternative approach where there's a single project, and companies are created as Organization resources under it. The key question is how to implement access control in this setup, ensuring that each org admin can only access data for their organization. We would appreciate your insights and recommendations regarding the feasibility of our proposed approach.

Hi @vijay.hambar - your use case is actually very well supported by our Access policies Check out our docs here (https://www.medplum.com/docs/auth/access-control#healthcare-partnerships)

"resource": [
    {
      "resourceType": "Patient",
      "readonly": true,
      "compartment": {
        "reference": "Organization/a23a2966-d58a-4098-b41b-e8f18bcda339",
        "display": "Example Customer Organization"
      }
    }
  ]

This rule says that only give access Patients in teh compartment for "Example Cusotmer Organization" How does this "compartment" get written? By setting the "meta.account" property, as seen in this example:

{
  "resourceType": "Patient",
  "id": "54aa8595-e3a7-48ae-af91-9c7cb940149b",
  "meta": {
    "versionId": "02900c57-4da8-498f-85d5-5077077e3e2c",
    "lastUpdated": "2022-01-13T16:21:11.870Z",
    "account": {
      "reference": "Organization/a23a2966-d58a-4098-b41b-e8f18bcda339",
      "display": "Example Customer Organization"
    }
  },
  "name": [
    {
      "given": [
        "Homer"
      ],
      "family": "Simpson"
    }
  ]
}

Thank you, will try the same.