Access control

[AnnaFeiler]

Since most hospitals currently don't support access control, we need to provide allowlists for our devices.

• Define a common format for allowlists
• Specify the allowlist format in SDPi - use of allowlists is not mandatory, if hospitals can do access control in a different way. If they are used, they need to follow the defined format.
• If needed, specify how to improve access control in the future without using allowlists

[ToddCooper]

@MartinKasp - this is a simple list of endpoint references
Question also about similar approaches in common use in hospitals (e.g., OAuth) (note: gRPC & FHIR use).
Do not want to "reinvent the wheel" ... especially in the area of cybersecure devices
NOTE: TF-2 Appendix C Security will be the place to collect this information.