diff --git a/daq/src/aaredaq/server.py b/daq/src/aaredaq/server.py
index 1b7b4637..907142e7 100644
--- a/daq/src/aaredaq/server.py
+++ b/daq/src/aaredaq/server.py
@@ -47,13 +47,40 @@ async def login(form_data: OAuth2PasswordRequestForm = Depends()):
 @app.get("/status")
 async def status(token: str = Depends(oauth2_scheme)) -> DAQStatusModel:
     data = auth.parse_token(token)
-    auth.check_jwt_ro(cfg, data)
+
     try:
-        ret = daq.status
-        ret.session = SessionStatus(current_pgroup=cfg.pgroup,
-                                    session=cfg.session_state(data.session),
-                                    staff=data.staff)
-        return ret
+        full = daq.status
+        active_pgroup = cfg.pgroup
+        is_staff = data.staff
+        in_allowed_groups = (active_pgroup is not None and active_pgroup in data.pgroups)
+        in_ro = is_staff or in_allowed_groups
+        sample_pgroup = full.sample.user if full.sample is not None else None
+        sample_view_allowed = sample_pgroup in data.pgroups or is_staff
+
+        masked_sample = full.sample if in_ro and sample_view_allowed else None
+        masked_box = full.box if in_ro else None
+        masked_best_res = full.last_best_res if in_ro else None
+        masked_best_b = full.last_best_b_factor if in_ro else None
+        masked_crystal = full.crystal_size if in_ro else CrystalSize(x=0,y=0,z=0)
+
+        return DAQStatusModel(
+            state=full.state,
+            busy=full.busy,
+            geom=full.geom,
+            diffraction=full.diffraction,
+            bl=full.bl,
+            sample=masked_sample,
+            session=SessionStatus(
+                current_pgroup=cfg.pgroup,
+                session=cfg.session_state(data.session),
+                staff=data.staff
+            ),
+            box=masked_box,
+            last_best_res=masked_best_res,
+            last_best_b_factor=masked_best_b,
+            crystal_size=masked_crystal
+        )
+
     except Exception as e:
         raise HTTPException(
             status_code=api_status.HTTP_500_INTERNAL_SERVER_ERROR,