How to Implement Scoped Patient Consent in a FHIR API

Giving an application access to a patient's health record isn't a single yes-or-no decision. A medication-reminder app needs to see prescriptions and nothing else. A billing system needs claims data but has no legitimate reason to see clinical notes.