I'd prefer not to complicate this factory with this input. Field level security is an internal implementation detail and not a tunable algorithm that is injected by the user of SPA. Internally we may choose to inject alternate implementations for unit test purposes but I don't think we should burden the SPA user with this. Same goes for all the following constructor signatures.