RBAC

Access control, down to the field.

Tag sensitive fields once, then attach those tags to roles to set who can read, write, or mask each slice of data.