ShotGrid Permission Rules YAML field-level restrictions and REST API null-vs-omitted behavior

ShotGrid Permission Rules YAML supports field-level read and edit restrictions for groups or permission roles. The server evaluates permissions per API credential, so an admin script and a restricted artist account can receive different payloads for the same entity. Current behavior indicates inaccessible fields may return as null rather than omitted, but clients cannot distinguish an empty value from a denied field using the response alone; exact semantics may vary by ShotGrid version.

Schema introspection describes field existence and editability metadata, yet effective visibility is computed per request, so a cached schema does not capture the permission boundary. ShotGrid emits no invalidation signal when a YAML rule changes, and permission edits do not appear as entity events in the event log.

Goal: define how clients should cache entity fields when ShotGrid field-level permission rules may change between requests.

Which response header, event entry, or schema version can clients use to invalidate cached field values after a permission rule change? Should clients treat null values as permission-denied, empty, or unknown without a separate introspection call? Is there a documented cache TTL or invalidation pattern for field-level permission boundaries?