public class JsonPermissionBasedFormatter : PartialJsonMediaTypeFormatter
    {
        public override MediaTypeFormatter GetPerRequestFormatterInstance(Type type, HttpRequestMessage request, MediaTypeHeaderValue mediaType)
        {
            User user = request.GetOwinContext()?.Request.Get<User>("AuthorizationFilter:CurrentUser");
            var formatter = (PartialJsonMediaTypeFormatter)base.GetPerRequestFormatterInstance(type, request, mediaType);
             formatter.SerializerSettings = SerializerSettings;
            formatter.SerializerSettings.ContractResolver = new PermissionBasedContractResolver(user);
            return formatter;
        }
    }

public PermissionBasedContractResolver(User user)
    {
        _user = user;
        NamingStrategy = new CamelCaseNamingStrategy
        {
            ProcessDictionaryKeys = true,
            OverrideSpecifiedNames = true
        };
    }

    protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization)
    {
        if (member == null)
        {
            throw new ArgumentNullException(nameof(member));
        }
        JsonProperty property = base.CreateProperty(member, memberSerialization);

        var propertyInfo = member as PropertyInfo;
        if (propertyInfo != null)
        {
            if (!PermissionsHelper.IsPropertyVisibleForUser(propertyInfo, _user))
            {
                property.ShouldSerialize = DoNotSerialize;
            }
        }
        return property;
    }

    static bool DoNotSerialize(object o)
    {
        return false;
    }
}

Parallel.For(1, 10000, _ =>
            {
                Get(ordinaryUser, isAdmin: false);
                Get(adminUser, isAdmin: true);
            });