How would you design Cache-Control headers for API responses that range from public reference data to sensitive user-specific data?

In production I separate browser, CDN, gateway, and application-cache behavior because each layer can have a different policy and purge mechanism. I document who owns invalidation, use surrogate controls only when the intermediary supports them, and test responses through the actual edge path. Cache directives must remain correct on errors, redirects, and authorization failures as well as 200 responses. I also define whether stale content may be served during revalidation or origin failure, because that availability trade-off must be explicit rather than an intermediary surprise. I monitor hit ratio, age, revalidation, stale serves, and accidental personalization signals, and I keep a rapid purge path for security or correctness incidents.