I think the Windows registry has this, doesn't it? Not really applicable to this use case, and do far as I know it's world-readable (acls are applied for writing, not reading) but it does have per-key ACLs (not sure about per-field).