The user gets a DTO, the admin gets the full model, same repository, same query, different shapes
You can't accidentally leak admin data to a user endpoint if it never had access to it in the first place
Not an API, full Livewire but the principle holds whether you're returning JSON or not