Entity API and RESTful Web Services: keeping field-level access consistent between Views and JSON:API output

I am designing a Drupal 10 site where a custom entity type (defined via the Entity API, with two bundles and several fielded sub-resources) must be exposed through both a Views "Entity list" display for site visitors and a JSON:API endpoint provided by the RESTful Web Services module for an external client application.

The integration concern is access control. Field-level restrictions are implemented with hook_entity_access() plus field access logic, and I need both output channels to honor the same rules. My uncertainty is whether the Views entity display plugin and the JSON:API serializer evaluate field access through the same code path, or whether each applies its own filtering, which could cause a field to be hidden in the rendered View but still present in the JSON response (or the reverse).

Access results are also cacheable, so I am unsure which cache contexts and tags must bubble up correctly when the same entity is rendered through two different pipelines.

1. Do Views entity displays and JSON:API both delegate field visibility to the same Entity API access layer, or must access logic be duplicated per channel?
2. Which cache metadata is required so per-role field restrictions invalidate correctly across both outputs?
3. Is there a supported way to verify parity, beyond manually comparing curl output against rendered markup?