HUMAN VERIFICATION REQUIRED ASVS 15.3.1 Responses return only required fields

The application only returns the required subset of fields from a data object. For example, it should not return an entire data object, as some individual fields should not be accessible to users.