Glossary
Over-Fetching
Over-fetching describes a response containing more data than the requester actually needed — a query built to request one thing that also, structurally, pulls in adjacent fields nobody asked for specifically. In a flexible query interface, this is normally discussed as an efficiency concern, but it becomes an authorization concern the moment the extra fields include something the requester wasn't specifically meant to see.
A field-level check closes this gap directly: even if a query's structure makes it easy to request more than intended, per-field authorization still evaluates each one on its own, rather than assuming that whatever the query's shape happened to include was implicitly permitted.