For JSON API requests with including only particular fields it requires putting resource name to separate fields per resource, it better to add the same for access check. Example:
/jsonapi/node--article?include=field_tags&jsonapi_access[taxonomy_term--tags]=update,delete
In case if you don't need to check access for some other resources, 'cause it can be performance consuming.

Comments

zviryatko created an issue.