A diff view can show hunks from fields the viewer is not allowed to read

Diff endpoints often load two versions of a document and return every changed line. Field-level read rules that the normal detail page respects get skipped, because the handler treats the diff as a single "can view document" check.

Sam is a contractor with access to the ticket body but not to the internal cost field. Opening the version history still shows a hunk that adds "cost: 4800" from an older save, because the diff builder never filtered fields by Sam's grants.

When you build a diff, run the viewer's field read check on each side before you include a hunk. Drop hunks for fields the viewer cannot read on either version. If a whole section is restricted, omit it rather than redacting after the fact in the client.

Quick test: grant a user read on title and body only, edit a restricted field in a new version, open the diff as that user. The restricted field's hunk must be absent from the API response, not just hidden in the UI.