How do I limit which fields specific user roles can even see?

Hey folks. We're rolling out ServiceNow GRC and hitting a classic permissions wall. I know how to restrict create/read/write on records, but we need to go deeper.

Some teams (like external auditors) should only see a *subset of fields* on a risk record—maybe just ID, title, and status. They shouldn't even know other custom fields exist. I've poked at ACLs and UI Policies, but hiding fields feels different from securing them at the data layer.

Has anyone set up true field-level visibility per role? Looking for:

- The cleanest approach (ACL vs. UI Policy vs. something else)
- Any performance gotchas when scaling this
- How you handle list views and reports

Real-world examples would be awesome. Thanks!