Your API should never return the model: what UserResource keeps out of my responses

Good question — and yes, the admin list almost always needs fields the public shape shouldn't have. My rule of thumb: one resource per audience. UserResource stays the public contract, and I'll make an AdminUserResource that extends it and adds the internal fields — roles, last_login_at, email_verified_at, that sort of thing. That way both whitelists stay tight, and an admin-only field can never leak into a public response just because someone reused the resource in the wrong controller. It's a bit more boilerplate, but it's exactly the kind of duplication that's cheaper than a leak.