Remove sensitive fields from a record based on roles. Returns a new object — does not mutate the original. Most-restrictive: if ANY role requires sanitization, apply it.
The full student/entity record
The requesting user's roles
Record with sensitive fields removed if applicable
Remove sensitive fields from a record based on roles. Returns a new object — does not mutate the original. Most-restrictive: if ANY role requires sanitization, apply it.