How can I ensure a user field is hidden by default for the logged in user? Module X provides a field-definition and attaches it to the user-entity.

Attaching metadata to the user in that way makes for a very convenient way to access it across the site.

However, by default, a logged in user will also be able to both view and edit this data, which is not always desirable.

Is there a way for the same module to ensure that this field is hidden by default?
If you don't want to depend from a module implemented by others, you can implement hook_field_access() in your own module. It is quite easy to change the access permission for an entity field, knowing its name.

function mymodule_field_access($op, $field, $entity_type, $entity, $account) {
  if ($field['field_name'] == 'field_of_interest' &amp;&amp; $op == 'edit') {
    return user_access('edit field of interest', $account);
  }
  return TRUE;
}


$op is 'edit', or view'; $entity contains the object for the entity to which the field is attached; $entity_type is the entity type.

With a module that aims the specific fields for which you want to control the access, it is easy to enable the access control: Just enable the module when you need it, and disable it when the access control is not necessary.