I don’t remember everything, but few thoughts to think about the problem.
- Clinical is not an app, it is a shortcut (perhaps a product level app but not technically). Dashboard, Prescription, Observation, etc are apps. Consultation is also an app in a way that displays multiple apps inside it.
- So, following from that. Clinical can be used as a namepsace but assigning and deriving permissions based on that would kill the configurability.
Each app should have their own permissions independent of other apps. Again, the apps shouldn’t derive their permissions from “Clincial”. To make this process easier, I remember we defined product in-built roles which provided all permissions necessary - so that the implementer works only at the role level and never has to to think about permissions.