Policy-Based Access Control in Federated Clinical Question Answering