In Part 1 , we established pragmatic boundaries for data access with SQLAlchemy 2.0. In Part 2 , we tackled the Pass-Through Service trap using hook-driven lifecycle execution. In Part 3 , we resolved route shadowing and architectural coupling in HTTP delivery layers.

Now, we face a friction point that emerges as backend domain models mature: Schema Explosion .

When an API serves multiple user roles (such as Public Visitors, Authenticated Customers, Support Staff, and System Admins), exposing domain entities safely becomes a maintenance bottleneck. In this post, we analyze why static Pydantic DTO proliferation breaks codebases, evaluate the failure modes of manual field pruning, and implement a robust, recursive, and fail-closed field pruning pattern in vanilla Pydantic V2.

1. The Common Doctrine vs. The Frustrating Reality

Standard FastAPI guidance recommends declaring explicit Pydantic response models for every API endpoint:

"Never return ORM models directly!…