When an edge/join definition declares its own projection (AQL::FIELDS / AQL::SKIN_FIELDS), that ad-hoc field list replaces the target model's $fields — so the Field::REQUIRES markers carried by the target model are not applied, and a field hidden from reading could be re-projected in clear through the relation. This helper closes that hole by dropping every projected field whose source attribute is refused by the target model's own projection (isPathAuthorized() against $documents->fields), mirroring the read-side gate applied everywhere else.

The source attribute — Field::NAME when the field aliases a document attribute, otherwise the output key — is what gets gated, never the output label, so an alias cannot dodge (or borrow) the wrong permission.

Relation-scoped OR alternative — Field::SELF_REQUIRES. A field refused by the target model is nonetheless kept when it declares Field::SELF_REQUIRES and the authorizer grants at least one of its subjects — the relation being a legitimately broader context (reading a sub-field of a resource the caller owns). This override lives only here: first-level model reads never pass through this helper, so it never widens a model's direct reads. The subjects are normalized to a non-empty list of strings before the check, so an empty / malformed value cannot borrow isAuthorized()'s "no subject → true" fail-open and re-open T6.

Fail-open and idempotent: with no target model, no $documents->fields, a field carrying no Field::REQUIRES on the target, or no authorizer injected, the field is kept — and re-running it on a projection that already came from $documents->fields changes nothing.