diff --git a/‎.changeset/21063-security-contract-zero-set-fields.md‎
Lines changed: 33 additions & 0 deletions b/‎.changeset/21063-security-contract-zero-set-fields.md‎
Lines changed: 33 additions & 0 deletions
diff --git a/‎.changeset/21063-zero-set-capability-fold.md‎
Lines changed: 40 additions & 0 deletions b/‎.changeset/21063-zero-set-capability-fold.md‎
Lines changed: 40 additions & 0 deletions
diff --git a/‎packages/plugins/plugin-security/src/get-writable-fields.test.ts‎
Lines changed: 7 additions & 3 deletions b/‎packages/plugins/plugin-security/src/get-writable-fields.test.ts‎
Lines changed: 7 additions & 3 deletions
@@ -0,0 +1,33 @@
+---
+'@objectstack/spec': minor
+---
+
+docs(spec)!: the security service contract's field answers for a caller who resolves no permission set exclude the fields that declare `requiredPermissions` (#21063)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) Only the prose of the ISecurityService interface moves: no method, parameter, return type, schema key or stored shape changes, so objectstack migrate meta has nothing to rewrite. The answers it now states are the ones every field-level requiredPermissions declaration already implied. -->
+
+**BREAKING for implementers and consumers of `ISecurityService` field answers.**
+
+**What changed.** The contract in `@objectstack/spec/contracts` now states the
+field answers for a non-system caller who resolves no permission set. Such a
+caller holds no permission-set field grant and no capability. No grant narrows
+its answers, and a field's own declarations still apply: a field that declares
+`requiredPermissions` is not in its `getReadableFields` answer (unless a
+`maskingRule` on the field serves it masked, which keeps it as a served
+column), and it is not in its `getWritableFields` answer.
+`getMetadataReadableFields` answers the same for that caller when the
+deployment's fallback set resolves to nothing. The contract used to say the
+data-plane answer for that caller was the full field set, because the engine
+middleware skipped its whole field gate for it. The middleware skips only its
+permission-set grant gates.
+
+**Who this reaches.** An implementation of `ISecurityService` must answer this
+way for that caller. A consumer that relied on the full field set for that
+caller now receives the narrower answer from the reference implementation
+(`@objectstack/plugin-security`).
+
+**What to do.** An implementation folds each field's `requiredPermissions`
+into its answer for this caller exactly as it does for a caller whose
+permission sets lack the capability. A consumer needs no change.
@@ -0,0 +1,40 @@
+---
+'@objectstack/plugin-security': minor
+---
+
+fix(plugin-security)!: a field that declares `requiredPermissions` is not served to a caller who resolves no permission set, and that caller may not query on it or write it (#21063)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing an author wrote is rewritten or changes meaning: every field-level requiredPermissions already declared mask on read and deny on write for a caller who does not hold all of it, and this change makes the runtime honour that declaration for the one caller class it skipped. No stored metadata, schema key or published type moves. -->
+
+**BREAKING for callers who resolve no permission set.**
+
+**What changed.** A field that declares `requiredPermissions` is masked on read
+and denied on write unless the caller holds all of them (ADR-0066 D3). A caller
+who carries a principal but resolves no permission set holds no capability, so
+the gate applies to it, but the runtime served that caller the stored value,
+let it filter, sort, group and aggregate on the field, and accepted a write
+that named it. The explain engine already reported the field hidden for that
+caller. Now the field is not served to it (a field that also declares a
+`maskingRule` is served masked, as before). A filter, sort key, group key or
+aggregate that names the field is refused with `403 PERMISSION_DENIED`, and so
+is a write payload that names it, as for any other caller who lacks the
+capability.
+
+The published field answers agree with what is served and refused.
+`ISecurityService.getReadableFields`, `getQueryableFields` and
+`getWritableFields` no longer list such a field for this caller, and neither
+does `getMetadataReadableFields` when the deployment's fallback set resolves to
+nothing. The write preview answers such a payload as the write path does.
+
+**Who this reaches.** A caller who resolves no permission set but carries a
+position, a named permission set or a user id. A caller with none of the three
+is handed through untouched, as before, and the field projections say so. A
+caller who resolves at least one permission set is unaffected, and so is a
+system context. Whether this caller may read or write the object at all is
+unchanged.
+
+**What to do.** Nothing, unless such a caller needs the field. A field's
+`requiredPermissions` name the capabilities that open it, so give the caller a
+permission set that holds all of them, or drop the requirement from the field.
@@ -158,9 +158,13 @@ describe('getWritableFields — the answers the contract names', () => {
     expect(await plugin.getWritableFields('invoice', { isSystem: true })).toEqual(FIELDS);
   });
 
-  it('no permission sets resolved: the full field set, as the middleware skips its write gate', async () => {
-    const { plugin } = await boot([], { noBaseline: true });
-    expect(await plugin.getWritableFields('invoice', WRITER_CTX)).toEqual(FIELDS);
+  it('no permission sets resolved: the full field set minus the capability-gated field, which the write gate refuses', async () => {
+    const { plugin, middleware } = await boot([], { noBaseline: true });
+    // [#21063] The caller holds no capability, so `margin`'s
+    // `requiredPermissions` refuses it on write; nothing else is refused.
+    expect(await plugin.getWritableFields('invoice', WRITER_CTX)).toEqual(FIELDS.filter((f) => f !== 'margin'));
+    expect(await middlewareAdmits(middleware, 'update', WRITER_CTX, { margin: PAYLOAD_VALUE.margin })).toBe(false);
+    expect(await middlewareAdmits(middleware, 'update', WRITER_CTX, { secret: PAYLOAD_VALUE.secret })).toBe(true);
   });
 
   it('an unresolvable object is no answer (undefined), not an empty one', async () => {