Can Ecto schema fields be marked private to avoid accidental JSON exposure?

The goal is to prevent sensitive schema fields from being exposed in API responses without relying on per-endpoint allow lists.

Ecto.Schema does not define a built-in private or public field option, and field visibility is not enforced at the schema or repository level. Output shaping is typically delegated to JSON serialization, such as Jason derive with only/except, or to a view layer that selects fields. Ecto.Changeset.cast/4 with :only or :except limits input parameters only. Virtual fields are not persisted but remain in the struct map and default encoding unless explicitly omitted.

With no schema-level visibility attribute, it is unclear where a consistent exclusion policy should live and whether accidental inclusion can be prevented at compile time.

Does Ecto provide a schema-level visibility attribute for output? Which pattern is considered idiomatic for consistent field exclusion across Repo queries and JSON encoding?