A user can open a table but cannot read one protected field. What is the most relevant security layer to inspect?

1. Only the navigation module title
2. Only the dashboard filter
3. Field-level read ACLs in addition to table access
4. Only the field's position on the form