...
- ABAC doesn't provide possibility to manage access to lists of resources
- It means that if there is a business rule that '/api/patients/{patient_id}/conditions/' should return only conditions that are referenced to episodes of the legal_entity. This rule will not be implemented on ABAC.
Architecture
