user model {
id string
secret string
}
scenario 1:
ability1: allows access to all fields for logged in users
ability2: allows access to the id for everyone
=> all fields should be in the schema
scenario 2:
ability1: allows access to id for logged in users
ability2: allows access to the id for everyone
=> secret should not be in the schema since it can never be seen anyway