---
title: "Return only the fields needed · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/access-control/only-needed-fields
id: APS-22
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 711
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Return only the fields needed

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Access control](https://agentwranglers.se/playbook/application-security/access-control.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-22
- Level: Recommended
- Chapter: [Access control](https://agentwranglers.se/playbook/application-security/access-control.md)
- Rule: Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
- Check: The agent reads replies about other users as a normal user. It finds no email address, password hash, internal note or field the page never shows.
- How: Build each reply from an explicit list of fields. Never return the stored object directly. Keep separate lists for the owner, other users and staff.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// Good: name the fields
res.json({ id: user.id, name: user.displayName });
// Bad: everything in the record, including the password hash
res.json(user);
```

### Python example

```python
# Python with Flask
return jsonify(id=user.id, name=user.display_name)
```

### PHP example

```php
// PHP with Laravel
return response()->json(['id' => $user->id, 'name' => $user->display_name]);
```

## Sources

- [OWASP API3:2023 Broken Object Property Level Authorization](https://api-security.owasp.org/editions/2023/en/0xa3-broken-object-property-level-authorization/)

## Related rules

- API-10 [Give every response one shape](https://agentwranglers.se/playbook/api-design/requests-and-responses/response-shape.md) in API design
- DAT-12 [Select only the columns you use](https://agentwranglers.se/playbook/data/queries-and-indexes/select-columns.md) in Data and databases
- APP-75 [Mask sensitive values until people ask to see them](https://agentwranglers.se/playbook/app-ui/data-views/mask-sensitive-values.md) in Web app interface

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/access-control/only-needed-fields">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Accept only the fields you expect](https://agentwranglers.se/playbook/application-security/access-control/mass-assignment.md)
- [Access control](https://agentwranglers.se/playbook/application-security/access-control.md)