I am dealing with a scenario where one entity has a relationship with another (e.g., a Student has an Instructor, who is an Employee). I need to expose only certain fields of the related entity (like name and contactNumber from the Employee), while ensuring sensitive information (such as salary, address, etc.) remains hidden.

This is not a one-time problem—there are multiple cases in my application where related entities should reveal only certain fields, depending on the context. I want to find a general approach to handle this in a scalable and secure way.

What are the best practices for designing such relationships in a way that:

1. Ensures security and avoids exposing sensitive data?
2. Remains flexible and scalable, as more entities may require similar treatment in the future?

Should I be using DTOs, separate models, or something else? Any advice on design patterns or real-world examples would be appreciated.