[asafc]

Good catch, I think that built-in data filtering can actually be a good addition to this new standard. I imagine a rego rule in OPA (or any other policy language) can accept the result json and modify it in place before sending the sanitized/filtered response back to the frontend client.

This is not very performance efficient though - maybe if the source api supports it, the proxy can inject filters (via headers / query params) to the modified request based on the authorization policy.