A team hides Salary using a UI policy and assumes API users cannot read it. What is missing?

1. A larger form section title
2. A different column order
3. Server-enforced field access controls
4. A mandatory client-side tooltip