For AI agents: the documentation index is at /docs/aidbox/llms.txt. A Markdown version of this page is available at /docs/aidbox/modules/eprescription/epcs/access-management/configure-access-policies.md or by requesting it with the Accept: text/markdown header.
Aidbox Docs

Configure Access Policies

Acting User

Every call needs an acting user: the Aidbox User authenticated for the request. A request made with only a Client credential has no acting user, and the module returns 403.

Access Policies

bootstrap-admin does not require the caller to be an access manager. At a location with no administrator, any acting user allowed by your AccessPolicies can grant that role to themselves or to another user. Restrict this operation to deployment operators. See the AccessPolicy documentation for policy configuration. Do not expose it to EHR users or to an administration UI.

Write a policy for each operation and grant it to the smallest group that needs it:

  • POST /e-prescription/access/epcs/bootstrap-admin: the operators who set up locations during deployment.
  • GET /e-prescription/access/epcs/permissions: administrators.
  • GET /e-prescription/access/epcs/permissions/mine: the users who work in the prescribing UI.
  • GET /e-prescription/access/epcs/requests: access managers and the users named in access-change requests.
  • POST /e-prescription/access/epcs/requests: administrators.
  • POST /e-prescription/access/epcs/requests/<id>/approve: approvers, nominees, and administrators.
  • POST /e-prescription/access/epcs/requests/<id>/cancel: access managers and the users named in access-change requests.
  • GET /e-prescription/access/epcs/locations/<Location id>/status: access managers and the users who work in the prescribing UI.

The module checks each caller's role as described in Access-Change Requests.

Do not let any policy grant your users or clients direct read or write access to EPrescriptionAccessPermission and EPrescriptionAccessRequest resources. Direct access bypasses the module's role checks and audit records.

This example policy matches a field of your User resource. Replace data.role and its value with whatever your EHR stores on its users.

resourceType: AccessPolicy
id: erx-epcs-bootstrap-admin
engine: matcho
matcho:
  uri: /e-prescription/access/epcs/bootstrap-admin
  request-method: post
  user:
    data:
      role: deployment-operator

Last updated: