What about permissions? What if the logged in user is only allowed to see certain fields? Do I make a table that describes every possible field and which roles can access it? How do I know what's available to query, without reading docs? What about hypermedia? Do I have to gain knowledge about a large system's data structure to query it?