proposal: role-scoped field visibility (visibleTo)

[delchev]

A field is as visible as its entity. sensitive: removes one from the scoped surfaces (personal / partner), but nothing scopes a field on the surface everybody else uses — so a salary, a cost price or a credit limit reaches every caller who may read the record at all. Hiding the control in the UI is not a protection: the value is in the response the page rendered from, in the change history, and in the export.

The proposal adds an allow-list on the field:

permissions:
  - { role: Payroll }
  - { role: Administrator }

- name: Employee
  fields:
    - { name: dailyRate, type: decimal, visibleTo: [Payroll, Administrator] }

enforced where the data leaves the server: stripped from every response and ignored on every write, on every surface (owning the record is not a role), withheld from the field-level change trail, inherited by a derived total fed by it, and reflected in the UI from what the server withholds rather than from a role list evaluated in the client.

Allow-list, deliberately not the inverse hiddenFor: — a deny-list fails open: a role added to the application later sees the value, and a misspelled role exposes it.

The proposal also states what is rejected (an undeclared role, an empty list, the primary key / identity field / document title, a label token) and the one case that only warns: a report over a restricted field, which re-serves the figure to everyone the report admits — legitimate to author, never silent.

Implemented in the reference implementation as eclipse-dirigible/dirigible#6747 (issue eclipse-dirigible/dirigible#6550).

🤖 Generated with Claude Code