How to disallow read/update for column, by user role

What's the recommandation to allow read/updates of specific columns depending on the user role?

is it something that must be done on each API endpoint?

What are the best practices and tips to make this process simpler?