Field Guard 1.0.0 Config-driven per-field access control that fails closed. Denies a named field to anyone not explicitly granted the permission the site nominates, including administrators and user 1. Defines no permissions of its own and ships with an empty map, so installing it changes nothing until it is configured. Two properties distinguish it: Definition-level checks fail closed. JSON:API's FieldResolver::getFieldAccess() and Views' EntityField::access() ask whether a field may be filtered or sorted on, passing no entity. Returning neutral there leaves the Views handler in place and permits the JSON:API filter, so a guarded value can be probed by an exposed filter even though it is never rendered. Access is not resolved through AccountInterface::hasPermission(), which returns TRUE for every permission on an is_admin role or user 1 and would silently exempt the accounts most worth constraining. Roles are walked directly, is_admin roles skipped, so a grant is a reviewable line in a configuration diff. 22 tests, 145 assertions. Supports Drupal 10.6, 11.3 and 12.