Great questions.
I'm new to the public space, but I've worked with a large number of Healthcare providers and payers. In general I would say that like everything with Qlik Sense the beauty is that you can have "role" based specialists (if you choose to.) You don't HAVE to have different roles it could be 1 person. But the great thing is that you can take advantage of the staff you have and let their talents shine.
Say you have someone who is an expert in HTML/CSS type stuff. They could create a wonderful looking mashup and template. They could likely care less about the actual content that you choose to put in the template they just like creating good looking "templates." So you let them. Then you as the brains behind the applications simply drags/drops the pieces you want from the application(s) you want.
But wait you tell me that you have someone who is an API coding whiz? Well now you could be cooking with gas and create a mashup that really has some bells and whistles to it. Again they wouldn't necessarily care about what you actually present, just the "flow" of how it ends up presented and the end users interactions.
What????? Now you hired a data visualization guru who loves creating 5 dimensional charts with Picasso.JS that provides back rubs. Put them to work and they can build you a super custom mashup that utilizes the Qlik analytics engine but displays the data using their cool custom charts.
Since you've already started working with the Dev Hub I wanted to share a video I produced that demonstrates what I talked about regarding a "Template." Like you saw with the Mashup Editor, you are simply able to drag/drop your application objects into spots on the "template." The API's come into play if you want to be able to tie selections together across applications. Or clear selections. Or create shiny buttons that allow navigation etc.
When you share your mashups security is still enforced. So whether your users access the data from the Qlik Sense Hub, or via a link you send in an email, or via any type of mashup they will be authenticated and any authorizations are honored such as PII/PHI limitations etc.
Hope it helps,
Dalton
