multiple level table with permission check in CRUD api implementation

Question

I have a project that building medical treatment, on the top level we have the appointment table:

appointment
- id
- practice_id
- doctor_id
- ...