A hidden field can still leak through a filter

A sensitive value does not have to appear in a response to reveal information. If a caller can filter records by that value, repeated queries can narrow the possibilities. Sorting can reveal relative order even when the field itself is hidden.

Field Guard addresses this distinction in Drupal's field-access model. It applies configured permission requirements and denies protected definition-level access when no entity is available. That matters because JSON:API filtering and Views field checks can ask about a field definition without supplying a record.

No record means no record-specific decision

Imagine a protected review date. Hiding its rendered value does not close a query that asks whether the date falls before a supplied threshold. A field-access implementation that returns a neutral result when no entity is present can leave that query path available.

Field Guard denies the protected definition-level request. The tradeoff is deliberate: the guarded field is unavailable for those filtering and sorting operations even to permission holders. There is no entity in that check against which to make a narrower authorization decision.

Administrative status is not an explicit grant

Configured protection also requires a permission explicitly assigned through an ordinary role. Implicit superuser access and an administrative role's blanket permissions do not substitute for that grant. The authorization decision can therefore be reviewed in role configuration.

The module ships without protected fields. An omitted operation remains unprotected, and an empty permission value does not create a deny rule. Configuration review is part of adopting it.

Field access and write validation answer different questions

Controlling who may access a field is separate from controlling which incoming value a permitted writer may submit. Our article on Drupal validation constraints covers the latter. A site may need both controls, with tests for rendering, filtering, sorting, and attempted writes.

Review the Field Guard documentation and the query behavior your application depends on before guarding a field. The meaningful test is whether an unauthorized caller can learn the value through any supported access path.