Question: I'm trying to implement data access restrictions to models in my sails.js apis and am looking for a better solution.

So far I have policies that restrict access to particular actions on the controller, the policy modifies the request to include a filter that should always be added to a Model query. 
Something like:

```
{
  "owner" : "davepreston"
}

```

At this point I don't see any way to enforce (or simplify) the use of the filter though, so that if I use Model.find in my controller and forget to add the filter I may show too much data to the user.

**tldr;**
Is there a way to restrict data access in a model so that all controllers accessing the model get the same data access restrictions automatically?

Answer: 
One way could be to implement a so called "custom" [Model Methods](http://sailsjs.org/#/documentation/concepts/ORM/Models.html?q=model-methods-(aka-static-or-class-methods)). 

I don't know if it's a good practice to actually overwrite the normal "find" method as sails it self does some magic by creating functions like "FindOneByMyAttributeName" but you could implement a "findWithRestriction" method.

Also note that speaking about a model you are (theoretically) not suppose to access your request object (req) in there, so take the current user as a paramter of your custom function ;)

(on my own projects i stick to the policies, if your anxious about forgetting to restrict and access you could make some unit test to validate your right management)
I found somewhere that you could override the toJSON method of the model:
Override the toJSON() method of the model

```
module.exports = {
    attributes: {
        ...
        toJSON: function() {
            var obj = this.toObject();
            delete obj.password;
            return obj;
       }

```

And another possible solution (Don't know if this works in the latest version):

```
Model.find({select:['col1', 'col2','col3']})

```