Q. How can you restrict access to specific groups or individuals based on their role?

Answer...

There are default Federated attributes that can be used to identify the organization that a user belongs to (scopedAffiliation), as well as the individual user (targetedID). scopedAffiliation allows sufficient granularity to identify individual sub-organizations within larger consortia. Further attributes are available that add yet more granularity (e.g. role, specialty, or entitlement), and these can be configured on the subscribing organizations’ side on a per-publisher basis.