uld ensure that API access is allowed for
authorized requests and denied for unauthorized requests.

</p>

<p>

<em>Approach:</em> Authorization details can vary according to local policy,
and according to the access scenario (e.g. sharing data among
institution-internal subsystems vs. sharing data with trusted partners vs.
sharing data with third-party user-facing apps). In general, FHIR enables a
separation of concerns between the FHIR REST API and standards-based
authorization protocols like OAuth. For t