Access control can now limit exposed fields