Problem

• Patient user creates a websocket Subscription resource to recieve incoming chats
• Admin would like to create an access policy to prevent Patient user from manipulating other Subscription resources
• The following policy won't work, because Subscriptions are not added to a Patient compartment

    {
      resourceType: 'Subscription',
      criteria: 'Subscription?type=websocket&_compartment=%profile',
    }

Possible Solutions

• Add an author search param (only to Subscriptions) to every resource that points to meta.author. Then we can restrict access as such:

    {
      resourceType: 'Subscription',
      criteria: 'Subscription?type=websocket&author=%profile',
    }

• Add Subscriptions to the Patient compartment (we would have to handle the case of Practitioner users seperately)
• ???