Deny Properties and Audit Roles

An allow-list is the safest design, but sometimes a role needs to read nearly everything. A support agent might need every propertyA named value stored on a node or a relationship. of every movie and rating, with a few personal details removed. Listing every allowed property would be long and easy to get wrong.

For that case, grant broad access and then DENY the specific properties to hide.