@@ -2,7 +2,8 @@
 
 ## Changes
 
-- `ToGraphQLSchemaString(QueryRequestContext? requestContext, bool includeDescriptions = true)` outputs SDL containing only the types and fields the user in the request context is authorized to access - the same rules introspection applies (protected types, and fields that are protected or return a protected type, are left out; the mutation/subscription root is omitted when none of its fields are visible). Useful for handing a schema to a user or AI agent (e.g. an MCP server tool) where SDL is more compact than introspection. `ToGraphQLSchemaString()` without a context still outputs the full schema.
+- `ToGraphQLSchemaStringAsync(ClaimsPrincipal? user)` (and `ToGraphQLSchemaString(QueryRequestContext? requestContext)`) output SDL containing only what that user may access, using the schema's `AuthorizationService` as query execution does. The result is self-consistent: a type the filtering leaves empty is hidden along with the fields returning it, a field is hidden when an argument's type is hidden, and hidden interfaces and union members are dropped from `implements` and union lists. Useful for handing a schema to a user or AI agent (e.g. an MCP server tool) where SDL is more compact than introspection. `ToGraphQLSchemaString()` without a user still outputs the full schema. Both are default interface methods on `ISchemaProvider`, so custom implementations do not break.
+- Introspection for a user now hides the same things the SDL does. Previously a type with no type-level authorization but every field protected was still listed (with `fields: []`), a field taking an argument of a protected enum or input type was listed, and protected interfaces still appeared in `interfaces`. These are now hidden, so a client building a schema from introspection gets a valid one. Introspection without a user is unchanged.
 - `[Required]` on an argument (a property/field of an arguments object or a method parameter) now behaves like `ArgumentHelper.Required<T>()` - the argument has no default value and must be provided by the query. Previously a value type kept its implicit `default(T)` as the schema default, so `[Required] int Take` printed `take: Int! = 0` (optional for clients) and a query leaving it out ran with `0`. It is now `take: Int!` and leaving it out is a `missing required argument` error. Remove `[Required]` if you relied on the old default.
 - Introspection `__InputValue.defaultValue` no longer strips the quotes off string-like defaults. The spec defines it as the GraphQL literal, so a string default of `hello` is now returned as `"hello"` - the same text as in the SDL. Clients building a schema from introspection (`buildClientSchema`, GraphiQL, codegen against an endpoint) previously dropped such defaults or failed to parse them (`Guid`, strings with spaces). If you read `defaultValue` directly as text rather than parsing it as GraphQL, string defaults now include their quotes.
 
 
@@ -65,13 +65,14 @@ Introspection queries (`__schema` and `__type`) respect authorization — the re
 
 `schema.ToGraphQLSchemaString()` always outputs the full schema — use it to generate SDL files for tooling and type generation.
 
-To get SDL filtered for a user, pass a `QueryRequestContext`. The same rules as introspection apply: protected types are left out, as are fields that are protected or return a protected type.
+To get SDL filtered for a user, use `ToGraphQLSchemaStringAsync(user)`. It uses the schema's `AuthorizationService` exactly as query execution does, and applies the same rules as introspection.
 
 ```cs
-var requestContext = new QueryRequestContext(await schema.AuthorizationService.PrepareForRequestAsync(schema, user), user);
-var sdl = schema.ToGraphQLSchemaString(requestContext);
+var sdl = await schema.ToGraphQLSchemaStringAsync(user);
 ```
 
+The result is self-consistent SDL: nothing in it refers to a type it does not define. Protected types are left out, as are fields that are protected, return a hidden type or take an argument of a hidden type. A type whose fields are all hidden is itself hidden, which can in turn hide the fields returning it. Protected interfaces are dropped from `implements` lists, and protected types from union member lists. The query root always stays, even with no visible fields. Introspection hides exactly the same types and fields, so `__schema`, `__type` and the SDL agree.
+
 This is useful when handing a schema to a person or an AI agent (e.g. an MCP server tool), where fields they cannot query are noise or information they should not have. SDL is far more compact than an introspection result for the same information.
 
 ## Mutations
 
@@ -1,5 +1,8 @@
 using System;
 using System.Collections.Generic;
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
 using EntityGraphQL.Compiler.EntityQuery;
 using EntityGraphQL.Directives;
 using Microsoft.Extensions.Logging;
@@ -93,7 +96,17 @@ void AddMutationsFrom<TType>(SchemaBuilderOptions? options = null)
     void RemoveTypeAndAllFields<TSchemaType>();
     void RemoveTypeAndAllFields(string typeName);
     string ToGraphQLSchemaString(bool includeDescriptions = true);
-    string ToGraphQLSchemaString(QueryRequestContext? requestContext, bool includeDescriptions = true);
+
+    /// <summary>SDL with only what the user in <paramref name="requestContext"/> may see. See SchemaProvider for details.</summary>
+    // default implementations so adding these does not break anyone implementing ISchemaProvider themselves
+    string ToGraphQLSchemaString(QueryRequestContext? requestContext, bool includeDescriptions = true) => SchemaGenerator.Make(this, includeDescriptions, requestContext);
+
+    /// <summary>SDL with only what <paramref name="user"/> may see, filtered by this schema's AuthorizationService. See SchemaProvider for details.</summary>
+    async Task<string> ToGraphQLSchemaStringAsync(ClaimsPrincipal? user, bool includeDescriptions = true, CancellationToken cancellationToken = default)
+    {
+        var authorizationService = await AuthorizationService.PrepareForRequestAsync(this, user, cancellationToken);
+        return SchemaGenerator.Make(this, includeDescriptions, new QueryRequestContext(authorizationService, user));
+    }
     SchemaType<TType> Type<TType>();
     SchemaType<TType> Type<TType>(string typeName);
     ISchemaType Type(string typeName);
 
@@ -24,21 +24,22 @@ internal static string EscapeString(string? input)
         return input.Replace("\\", "\\\\").Replace("\"", "\\\"");
     }
 
-    /// <param name="requestContext">When supplied only types and fields this user may access are output, using the same
-    /// rules as introspection (see <see cref="SchemaIntrospection.IsVisible(QueryRequestContext?, IField)"/>). Null outputs everything</param>
+    /// <param name="requestContext">When supplied only the types and fields this user may access are output, using the same
+    /// rules as introspection (see <see cref="SchemaVisibility"/>). Null outputs everything</param>
     internal static string Make(ISchemaProvider schema, bool includeDescriptions = true, QueryRequestContext? requestContext = null)
     {
+        var visibility = SchemaVisibility.For(schema, requestContext);
         var rootQueryType = schema.GetSchemaType(schema.QueryContextType, false, null);
         var mutationType = schema.Mutation().SchemaType;
         var subscriptionType = schema.Subscription().SchemaType;
 
-        var types = BuildSchemaTypes(schema, includeDescriptions, requestContext);
+        var types = BuildSchemaTypes(schema, includeDescriptions, visibility);
 
         var schemaBuilder = new StringBuilder("schema {");
         schemaBuilder.AppendLine();
         schemaBuilder.AppendLine($"\tquery: {rootQueryType.Name}");
-        bool outputMutation = VisibleFields(mutationType, requestContext).Any();
-        bool outputSubscription = VisibleFields(subscriptionType, requestContext).Any();
+        bool outputMutation = VisibleFields(mutationType, visibility).Any();
+        bool outputSubscription = VisibleFields(subscriptionType, visibility).Any();
         if (outputMutation)
             schemaBuilder.AppendLine($"\tmutation: {mutationType.Name}");
         if (outputSubscription)
@@ -64,32 +65,32 @@ internal static string Make(ISchemaProvider schema, bool includeDescriptions = t
         }
         schemaBuilder.AppendLine();
 
-        schemaBuilder.Append(BuildEnumTypes(schema, includeDescriptions, requestContext));
+        schemaBuilder.Append(BuildEnumTypes(schema, includeDescriptions, visibility));
 
-        schemaBuilder.AppendLine(OutputSchemaType(schema, schema.GetSchemaType(schema.QueryContextName, null), includeDescriptions, requestContext));
+        schemaBuilder.AppendLine(OutputSchemaType(schema, schema.GetSchemaType(schema.QueryContextName, null), includeDescriptions, visibility));
 
         schemaBuilder.Append(types);
 
         if (outputMutation)
-            schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Mutation().SchemaType, includeDescriptions, requestContext));
+            schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Mutation().SchemaType, includeDescriptions, visibility));
         if (outputSubscription)
-            schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Subscription().SchemaType, includeDescriptions, requestContext));
+            schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Subscription().SchemaType, includeDescriptions, visibility));
 
         return schemaBuilder.ToString();
     }
 
-    /// <summary>Fields of a type that are output: not internal (__) and, with a request context, visible to that user</summary>
-    private static IEnumerable<IField> VisibleFields(ISchemaType schemaType, QueryRequestContext? requestContext) =>
-        schemaType.GetFields().Where(f => !f.Name.StartsWith("__", StringComparison.InvariantCulture) && SchemaIntrospection.IsVisible(requestContext, f));
+    /// <summary>Fields of a type that are output: not internal (__) and visible to the user, if filtering</summary>
+    private static IEnumerable<IField> VisibleFields(ISchemaType schemaType, SchemaVisibility visibility) =>
+        schemaType.GetFields().Where(f => !f.Name.StartsWith("__", StringComparison.InvariantCulture) && visibility.IsFieldVisible(f));
 
-    private static string BuildEnumTypes(ISchemaProvider schema, bool includeDescriptions, QueryRequestContext? requestContext)
+    private static string BuildEnumTypes(ISchemaProvider schema, bool includeDescriptions, SchemaVisibility visibility)
     {
         var types = new StringBuilder();
         foreach (var typeItem in schema.GetNonContextTypes().OrderBy(t => t.Name))
         {
             if (typeItem.Name.StartsWith("__", StringComparison.InvariantCulture) || !typeItem.IsEnum)
                 continue;
-            if (!SchemaIntrospection.IsVisible(requestContext, typeItem.RequiredAuthorization))
+            if (!visibility.IsTypeVisible(typeItem))
                 continue;
 
             if (includeDescriptions && !string.IsNullOrEmpty(typeItem.Description))
@@ -113,7 +114,7 @@ private static string BuildEnumTypes(ISchemaProvider schema, bool includeDescrip
         return types.ToString();
     }
 
-    private static string BuildSchemaTypes(ISchemaProvider schema, bool includeDescriptions, QueryRequestContext? requestContext)
+    private static string BuildSchemaTypes(ISchemaProvider schema, bool includeDescriptions, SchemaVisibility visibility)
     {
         var types = new StringBuilder();
         foreach (var typeItem in schema.GetNonContextTypes().OrderBy(t => t.Name))
@@ -127,15 +128,15 @@ private static string BuildSchemaTypes(ISchemaProvider schema, bool includeDescr
             )
                 continue;
 
-            if (!SchemaIntrospection.IsVisible(requestContext, typeItem.RequiredAuthorization))
+            if (!visibility.IsTypeVisible(typeItem))
                 continue;
 
             if (!typeItem.GetFields().Any(f => !f.Name.StartsWith("__", StringComparison.InvariantCulture)) && typeItem.GqlType != GqlTypes.Union && typeItem.BaseTypesReadOnly.Count == 0)
                 continue;
 
-            var output = OutputSchemaType(schema, typeItem, includeDescriptions, requestContext);
+            var output = OutputSchemaType(schema, typeItem, includeDescriptions, visibility);
             // without a request context keep the historic output byte-for-byte (it appended even an empty union)
-            if (output.Length > 0 || requestContext == null)
+            if (output.Length > 0 || !visibility.IsFiltering)
                 types.AppendLine(output);
         }
 
@@ -260,20 +261,17 @@ private static string GetDirectiveArgs(ISchemaProvider schema, IDirectiveProcess
         return string.IsNullOrEmpty(allArgs) ? string.Empty : $"({allArgs})";
     }
 
-    private static string OutputSchemaType(ISchemaProvider schema, ISchemaType schemaType, bool includeDescriptions, QueryRequestContext? requestContext)
+    private static string OutputSchemaType(ISchemaProvider schema, ISchemaType schemaType, bool includeDescriptions, SchemaVisibility visibility)
     {
         var sb = new StringBuilder();
-        var fields = VisibleFields(schemaType, requestContext).OrderBy(s => s.Name).ToList();
-        // every field hidden from this user - an empty type is not valid SDL, and the type is not reachable anyway
-        if (requestContext != null && fields.Count == 0 && schemaType.GqlType != GqlTypes.Union)
-            return string.Empty;
+        var fields = VisibleFields(schemaType, visibility).OrderBy(s => s.Name).ToList();
 
         if (includeDescriptions && !string.IsNullOrEmpty(schemaType.Description))
             sb.AppendLine($"\"\"\"{EscapeString(schemaType.Description)}\"\"\"");
 
         if (schemaType.GqlType == GqlTypes.Union)
         {
-            var possibleTypes = schemaType.PossibleTypesReadOnly.Where(i => SchemaIntrospection.IsVisible(requestContext, i.RequiredAuthorization)).ToList();
+            var possibleTypes = schemaType.PossibleTypesReadOnly.Where(visibility.IsTypeVisible).ToList();
             if (possibleTypes.Count == 0)
             {
                 return string.Empty;
@@ -292,9 +290,18 @@ private static string OutputSchemaType(ISchemaProvider schema, ISchemaType schem
         };
 
         var implements = "";
-        if (schemaType.BaseTypesReadOnly != null && schemaType.BaseTypesReadOnly.Count > 0)
+        var baseTypes = schemaType.BaseTypesReadOnly?.Where(visibility.IsTypeVisible).ToList();
+        if (baseTypes != null && baseTypes.Count > 0)
         {
-            implements += $" implements {string.Join(" & ", schemaType.BaseTypesReadOnly.Select(i => i.Name))}";
+            implements += $" implements {string.Join(" & ", baseTypes.Select(i => i.Name))}";
+        }
+
+        // the query root can be left with no fields (SchemaVisibility hides any other type it empties). The SDL grammar
+        // allows a type with no field block, so it stays a parseable root rather than disappearing from under `schema`
+        if (visibility.IsFiltering && fields.Count == 0 && schemaType.Name == schema.QueryContextName)
+        {
+            sb.AppendLine($"{type} {schemaType.Name}{implements}{GetDirectives(schemaType.Directives)}");
+            return sb.ToString();
         }
 
         sb.AppendLine($"{type} {schemaType.Name}{implements}{GetDirectives(schemaType.Directives)} {{");