diff --git a/client b/client
index 4001db94..fd78cd73 160000
--- a/client
+++ b/client
@@ -1 +1 @@
-Subproject commit 4001db9446720f5426e105019a53acbe4c915624
+Subproject commit fd78cd73aa0af58c7b18553607ea2a04f8d457f2
diff --git a/common/proto/tables_data.proto b/common/proto/tables_data.proto
index 769f1cfa..39abd93a 100644
--- a/common/proto/tables_data.proto
+++ b/common/proto/tables_data.proto
@@ -275,7 +275,7 @@ message DeleteTableDataRequest {
 
 // Soft-delete response.
 message DeleteTableDataResponse {
-  // True if a row was marked deleted (id existed and was not already deleted).
+  // True when the row was successfully marked deleted.
   bool success = 1;
 }
 
@@ -307,6 +307,9 @@ enum ResolvedTableLinkStatus {
   SUPERSEDED = 1;
   UNAVAILABLE = 2;
   DELETED = 3;
+  // The source row may expose the FK and the target's configured display
+  // columns, but the caller may not read the target table itself.
+  RESTRICTED = 4;
 }
 
 message ResolvedTableLinkVersion {
@@ -349,7 +352,9 @@ message GetTableDataResponse {
   repeated string row_display_columns = 3;
 
   // Links keyed by their public column name. Each value contains the row as
-  // saved by this record and the newest available state of the linked row.
+  // saved by this record and, when the caller may read the target table, its
+  // newest available state. Restricted links contain only the target table's
+  // configured display columns.
   map<string, ResolvedTableLink> resolved_links = 4;
 
   // The generation returned by this response. Zero is never returned.
diff --git a/common/src/proto/descriptor.bin b/common/src/proto/descriptor.bin
index 8d8cb0f1..5ede8012 100644
Binary files a/common/src/proto/descriptor.bin and b/common/src/proto/descriptor.bin differ
diff --git a/common/src/proto/komp_ac.tables_data.rs b/common/src/proto/komp_ac.tables_data.rs
index 8876d849..c552f9be 100644
--- a/common/src/proto/komp_ac.tables_data.rs
+++ b/common/src/proto/komp_ac.tables_data.rs
@@ -217,7 +217,7 @@ pub struct DeleteTableDataRequest {
 /// Soft-delete response.
 #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct DeleteTableDataResponse {
-    /// True if a row was marked deleted (id existed and was not already deleted).
+    /// True when the row was successfully marked deleted.
     #[prost(bool, tag = "1")]
     pub success: bool,
 }
@@ -309,7 +309,9 @@ pub struct GetTableDataResponse {
     #[prost(string, repeated, tag = "3")]
     pub row_display_columns: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
     /// Links keyed by their public column name. Each value contains the row as
-    /// saved by this record and the newest available state of the linked row.
+    /// saved by this record and, when the caller may read the target table, its
+    /// newest available state. Restricted links contain only the target table's
+    /// configured display columns.
     #[prost(map = "string, message", tag = "4")]
     pub resolved_links: ::std::collections::HashMap<
         ::prost::alloc::string::String,
@@ -352,6 +354,9 @@ pub enum ResolvedTableLinkStatus {
     Superseded = 1,
     Unavailable = 2,
     Deleted = 3,
+    /// The source row may expose the FK and the target's configured display
+    /// columns, but the caller may not read the target table itself.
+    Restricted = 4,
 }
 impl ResolvedTableLinkStatus {
     /// String value of the enum field names used in the ProtoBuf definition.
@@ -364,6 +369,7 @@ impl ResolvedTableLinkStatus {
             Self::Superseded => "SUPERSEDED",
             Self::Unavailable => "UNAVAILABLE",
             Self::Deleted => "DELETED",
+            Self::Restricted => "RESTRICTED",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -373,6 +379,7 @@ impl ResolvedTableLinkStatus {
             "SUPERSEDED" => Some(Self::Superseded),
             "UNAVAILABLE" => Some(Self::Unavailable),
             "DELETED" => Some(Self::Deleted),
+            "RESTRICTED" => Some(Self::Restricted),
             _ => None,
         }
     }
diff --git a/server b/server
index d927987c..d6dd48e6 160000
--- a/server
+++ b/server
@@ -1 +1 @@
-Subproject commit d927987c955234a0f322337ae3b017bce99c9e76
+Subproject commit d6dd48e6df0e0f61fe7605ee94c798a69da83886