For people finding this thread:
So, when you do a populate call to a controller, the request passes through Role-Based Access Control (RBAC). The response of the controller is then sanitised before being returned. If you make your request by doing something like super.find(ctx) where you’ve modified some part of the ctx to include a relation field.
Now, if you don’t really care (i.e. you think that the populate shouldn’t be being sanitised) you can add the following:
ctx.state.auth = null
If no auth object exists in the state, sanitising relations based on RBAC is skipped.