A 311 GraphQL API serves residents publicly but must keep internal priority-score fields out of public queries. What should developers enforce?

Applying field-level exposure controls so internal priority scores are omitted from the public GraphQL schema audience is what developers should enforce when a 311 GraphQL API serves residents publicly but must keep internal priority-score fields out of public queries. Public audiences get ticket status and appropriate resident-facing fields; internal operational scores remain in schemas or resolvers reserved for authenticated staff APIs. Field-level authorization or separate schema documents prevent accidental leakage of triage logic that residents should not see or game.

Exposing every column including internal scores to anonymous GraphQL clients fails by concept and publishes operational scoring. Removing authentication from mutations while leaving queries wide open worsens integrity and still fails to hide priority fields from public queries. Duplicating priority scores into a public REST resource labeled “safe” without review bypasses GraphQL field controls and often reintroduces the same sensitive values under another protocol.

Exam caveat: Audience-based field exposure is distinct from database RLS/DDM. You may still need RLS in SQL, but the GraphQL layer must not advertise or resolve internal fields for anonymous residents. On the exam, “public API” does not mean “every column.” Prefer explicit allow-lists of public fields over deny-lists that drift as schemas evolve.

Operational check: Split public versus internal GraphQL schemas or apply field directives/auth scopes that exclude priorityScore from the anonymous audience. Introspect as an anonymous resident and confirm the field is absent; introspect as a staff token and confirm it appears only where intended. Add CI tests that fail if internal fields regain public exposure. Review any parallel REST “safe” endpoints for duplicated sensitive fields before release.