#15 hide private LDs at service-dao layer rather than client filter