I modeled it with the backend as the source of truth for authorization. In Django REST, users have role-based access (Admin, Doctor, Patient), and custom permission checks are applied at the API/view level, with queryset filtering to ensure users only access the records relevant...