diff --git a/hugr-core/src/export.rs b/hugr-core/src/export.rs
index 72eddf974f..c3dca44d73 100644
--- a/hugr-core/src/export.rs
+++ b/hugr-core/src/export.rs
@@ -95,6 +95,8 @@ struct Context<'a> {
     // that ensures that the `node_to_id` and `id_to_node` maps stay in sync.
 }
 
+const NO_VIS: Option<Visibility> = None;
+
 impl<'a> Context<'a> {
     pub fn new(hugr: &'a Hugr, bump: &'a Bump) -> Self {
         let mut module = table::Module::default();
@@ -331,7 +333,7 @@ impl<'a> Context<'a> {
             OpType::FuncDefn(func) => self.with_local_scope(node_id, |this| {
                 let symbol = this.export_poly_func_type(
                     func.func_name(),
-                    func.visibility().clone().into(),
+                    Some(func.visibility().clone().into()),
                     func.signature(),
                 );
                 regions = this.bump.alloc_slice_copy(&[this.export_dfg(
@@ -345,7 +347,7 @@ impl<'a> Context<'a> {
             OpType::FuncDecl(func) => self.with_local_scope(node_id, |this| {
                 let symbol = this.export_poly_func_type(
                     func.func_name(),
-                    func.visibility().clone().into(),
+                    Some(func.visibility().clone().into()),
                     func.signature(),
                 );
                 table::Operation::DeclareFunc(symbol)
@@ -354,10 +356,8 @@ impl<'a> Context<'a> {
             OpType::AliasDecl(alias) => self.with_local_scope(node_id, |this| {
                 // TODO: We should support aliases with different types and with parameters
                 let signature = this.make_term_apply(model::CORE_TYPE, &[]);
-                // Visibility is not spec'd in hugr-core
-                let visibility = this.bump.alloc(Visibility::default()); // good to common up!?
                 let symbol = this.bump.alloc(table::Symbol {
-                    visibility,
+                    visibility: &NO_VIS, // not spec'd in hugr-core
                     name: &alias.name,
                     params: &[],
                     constraints: &[],
@@ -370,10 +370,8 @@ impl<'a> Context<'a> {
                 let value = this.export_type(&alias.definition);
                 // TODO: We should support aliases with different types and with parameters
                 let signature = this.make_term_apply(model::CORE_TYPE, &[]);
-                // Visibility is not spec'd in hugr-core
-                let visibility = this.bump.alloc(Visibility::default()); // good to common up!?
                 let symbol = this.bump.alloc(table::Symbol {
-                    visibility,
+                    visibility: &NO_VIS, // not spec'd in hugr-core
                     name: &alias.name,
                     params: &[],
                     constraints: &[],
@@ -548,8 +546,7 @@ impl<'a> Context<'a> {
 
         let symbol = self.with_local_scope(node, |this| {
             let name = this.make_qualified_name(opdef.extension_id(), opdef.name());
-            // Visibility of OpDef's has no effect
-            this.export_poly_func_type(name, Visibility::default(), poly_func_type)
+            this.export_poly_func_type(name, None, poly_func_type)
         });
 
         let meta = {
@@ -800,7 +797,7 @@ impl<'a> Context<'a> {
     pub fn export_poly_func_type<RV: MaybeRV>(
         &mut self,
         name: &'a str,
-        visibility: Visibility,
+        visibility: Option<Visibility>,
         t: &PolyFuncTypeBase<RV>,
     ) -> &'a table::Symbol<'a> {
         let mut params = BumpVec::with_capacity_in(t.params().len(), self.bump);
diff --git a/hugr-core/src/import.rs b/hugr-core/src/import.rs
index 7e10affafe..dc586964e4 100644
--- a/hugr-core/src/import.rs
+++ b/hugr-core/src/import.rs
@@ -938,12 +938,12 @@ impl<'a> Context<'a> {
         node_data: &'a table::Node<'a>,
         parent: Node,
     ) -> Result<Node, ImportError> {
+        let visibility = symbol.visibility.clone().ok_or(ImportErrorInner::Invalid(
+            "No visibility for FuncDefn".to_string(),
+        ))?;
         self.import_poly_func_type(node_id, *symbol, |ctx, signature| {
-            let optype = OpType::FuncDefn(FuncDefn::new_vis(
-                symbol.name,
-                signature,
-                symbol.visibility.clone().into(),
-            ));
+            let optype =
+                OpType::FuncDefn(FuncDefn::new_vis(symbol.name, signature, visibility.into()));
 
             let node = ctx.make_node(node_id, optype, parent)?;
 
@@ -967,12 +967,12 @@ impl<'a> Context<'a> {
         symbol: &'a table::Symbol<'a>,
         parent: Node,
     ) -> Result<Node, ImportError> {
+        let visibility = symbol.visibility.clone().ok_or(ImportErrorInner::Invalid(
+            "No visibility for FuncDecl".to_string(),
+        ))?;
         self.import_poly_func_type(node_id, *symbol, |ctx, signature| {
-            let optype = OpType::FuncDecl(FuncDecl::new_vis(
-                symbol.name,
-                signature,
-                symbol.visibility.clone().into(),
-            ));
+            let optype =
+                OpType::FuncDecl(FuncDecl::new_vis(symbol.name, signature, visibility.into()));
             let node = ctx.make_node(node_id, optype, parent)?;
             Ok(node)
         })
diff --git a/hugr-core/tests/snapshots/model__roundtrip_add.snap b/hugr-core/tests/snapshots/model__roundtrip_add.snap
index 456e44d14c..625b621f09 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_add.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_add.snap
@@ -25,6 +25,7 @@ expression: ast
       "addition modulo 2^N (signed and unsigned versions are the same op)")))
 
 (define-func
+  public
   example.add
   (core.fn
     [(arithmetic.int.types.int 6) (arithmetic.int.types.int 6)]
diff --git a/hugr-core/tests/snapshots/model__roundtrip_call.snap b/hugr-core/tests/snapshots/model__roundtrip_call.snap
index 50d9c55c33..dd6ed80449 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_call.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_call.snap
@@ -1,6 +1,6 @@
 ---
 source: hugr-core/tests/model.rs
-expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-call.edn\"))"
+expression: ast
 ---
 (hugr 0)
 
@@ -17,12 +17,14 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-call
 (import arithmetic.int.types.int)
 
 (declare-func
+  public
   example.callee
   (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])
   (meta (compat.meta_json "description" "\"This is a function declaration.\""))
   (meta (compat.meta_json "title" "\"Callee\"")))
 
 (define-func
+  private
   example.caller
   (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])
   (meta
@@ -41,6 +43,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-call
         (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])))))
 
 (define-func
+  private
   example.load
   (core.fn [] [(core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])])
   (dfg [] [%0]
diff --git a/hugr-core/tests/snapshots/model__roundtrip_cfg.snap b/hugr-core/tests/snapshots/model__roundtrip_cfg.snap
index f3f272fd21..934423d3aa 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_cfg.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_cfg.snap
@@ -16,7 +16,7 @@ expression: ast
 
 (import core.adt)
 
-(define-func example.cfg_loop (param ?0 core.type) (core.fn [?0] [?0])
+(define-func private example.cfg_loop (param ?0 core.type) (core.fn [?0] [?0])
   (dfg [%0] [%1]
     (signature (core.fn [?0] [?0]))
     (cfg [%0] [%1]
@@ -30,7 +30,7 @@ expression: ast
             ((core.make_adt 0) [%4] [%5]
               (signature (core.fn [?0] [(core.adt [[?0] [?0]])])))))))))
 
-(define-func example.cfg_order (param ?0 core.type) (core.fn [?0] [?0])
+(define-func public example.cfg_order (param ?0 core.type) (core.fn [?0] [?0])
   (dfg [%0] [%1]
     (signature (core.fn [?0] [?0]))
     (cfg [%0] [%1]
diff --git a/hugr-core/tests/snapshots/model__roundtrip_cond.snap b/hugr-core/tests/snapshots/model__roundtrip_cond.snap
index 8d972a305c..b29f755705 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_cond.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_cond.snap
@@ -25,6 +25,7 @@ expression: ast
       "negation modulo 2^N (signed and unsigned versions are the same op)")))
 
 (define-func
+  private
   example.cond
   (core.fn
     [(core.adt [[] []]) (arithmetic.int.types.int 6)]
diff --git a/hugr-core/tests/snapshots/model__roundtrip_const.snap b/hugr-core/tests/snapshots/model__roundtrip_const.snap
index 99cfdb55e9..3b386275ba 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_const.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_const.snap
@@ -1,6 +1,6 @@
 ---
 source: hugr-core/tests/model.rs
-expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-const.edn\"))"
+expression: ast
 ---
 (hugr 0)
 
@@ -28,7 +28,10 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
 
 (import core.adt)
 
-(define-func example.bools (core.fn [] [(core.adt [[] []]) (core.adt [[] []])])
+(define-func
+  public
+  example.bools
+  (core.fn [] [(core.adt [[] []]) (core.adt [[] []])])
   (dfg [] [%0 %1]
     (signature (core.fn [] [(core.adt [[] []]) (core.adt [[] []])]))
     ((core.load_const (core.const.adt [[] []] _ 0 [])) [] [%0]
@@ -37,6 +40,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
       (signature (core.fn [] [(core.adt [[] []])])))))
 
 (define-func
+  public
   example.make-pair
   (core.fn
     []
@@ -73,7 +77,10 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
              [[(collections.array.array 5 (arithmetic.int.types.int 6))
                arithmetic.float.types.float64]])])))))
 
-(define-func example.f64-json (core.fn [] [arithmetic.float.types.float64])
+(define-func
+  public
+  example.f64-json
+  (core.fn [] [arithmetic.float.types.float64])
   (dfg [] [%0 %1]
     (signature
       (core.fn
diff --git a/hugr-core/tests/snapshots/model__roundtrip_constraints.snap b/hugr-core/tests/snapshots/model__roundtrip_constraints.snap
index b9b406f3c5..fbe935cab0 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_constraints.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_constraints.snap
@@ -1,6 +1,6 @@
 ---
 source: hugr-core/tests/model.rs
-expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-constraints.edn\"))"
+expression: ast
 ---
 (hugr 0)
 
@@ -17,6 +17,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
 (import core.fn)
 
 (declare-func
+  private
   array.replicate
   (param ?0 core.nat)
   (param ?1 core.type)
@@ -24,6 +25,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
   (core.fn [?1] [(collections.array.array ?0 ?1)]))
 
 (declare-func
+  public
   array.copy
   (param ?0 core.nat)
   (param ?1 core.type)
@@ -33,6 +35,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-cons
     [(collections.array.array ?0 ?1) (collections.array.array ?0 ?1)]))
 
 (define-func
+  public
   util.copy
   (param ?0 core.type)
   (where (core.nonlinear ?0))
diff --git a/hugr-core/tests/snapshots/model__roundtrip_entrypoint.snap b/hugr-core/tests/snapshots/model__roundtrip_entrypoint.snap
index 5313b7257b..040c10f508 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_entrypoint.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_entrypoint.snap
@@ -10,7 +10,7 @@ expression: ast
 
 (import core.entrypoint)
 
-(define-func main (core.fn [] [])
+(define-func public main (core.fn [] [])
   (dfg (signature (core.fn [] [])) (meta core.entrypoint)))
 
 (mod)
@@ -19,7 +19,7 @@ expression: ast
 
 (import core.entrypoint)
 
-(define-func wrapper_dfg (core.fn [] [])
+(define-func private wrapper_dfg (core.fn [] [])
   (dfg (signature (core.fn [] [])) (meta core.entrypoint)))
 
 (mod)
@@ -34,7 +34,7 @@ expression: ast
 
 (import core.adt)
 
-(define-func wrapper_cfg (core.fn [] [])
+(define-func public wrapper_cfg (core.fn [] [])
   (dfg
     (signature (core.fn [] []))
     (cfg
diff --git a/hugr-core/tests/snapshots/model__roundtrip_loop.snap b/hugr-core/tests/snapshots/model__roundtrip_loop.snap
index 50035a637c..bdbb088e60 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_loop.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_loop.snap
@@ -1,6 +1,6 @@
 ---
 source: hugr-core/tests/model.rs
-expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-loop.edn\"))"
+expression: ast
 ---
 (hugr 0)
 
@@ -14,7 +14,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-loop
 
 (import core.adt)
 
-(define-func example.loop (param ?0 core.type) (core.fn [?0] [?0])
+(define-func private example.loop (param ?0 core.type) (core.fn [?0] [?0])
   (dfg [%0] [%1]
     (signature (core.fn [?0] [?0]))
     (tail-loop [%0] [%1]
diff --git a/hugr-core/tests/snapshots/model__roundtrip_order.snap b/hugr-core/tests/snapshots/model__roundtrip_order.snap
index ae92aa3ab2..31d74f7e0d 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_order.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_order.snap
@@ -27,6 +27,7 @@ expression: ast
       "negation modulo 2^N (signed and unsigned versions are the same op)")))
 
 (define-func
+  public
   main
   (core.fn
     [(arithmetic.int.types.int 6)
diff --git a/hugr-core/tests/snapshots/model__roundtrip_params.snap b/hugr-core/tests/snapshots/model__roundtrip_params.snap
index 9d7334d84a..eab6045e57 100644
--- a/hugr-core/tests/snapshots/model__roundtrip_params.snap
+++ b/hugr-core/tests/snapshots/model__roundtrip_params.snap
@@ -1,6 +1,6 @@
 ---
 source: hugr-core/tests/model.rs
-expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-params.edn\"))"
+expression: ast
 ---
 (hugr 0)
 
@@ -21,6 +21,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-para
 (import core.float)
 
 (define-func
+  public
   example.swap
   (param ?0 core.type)
   (param ?1 core.type)
@@ -28,6 +29,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-para
   (dfg [%0 %1] [%1 %0] (signature (core.fn [?0 ?1] [?1 ?0]))))
 
 (declare-func
+  public
   example.literals
   (param ?0 core.str)
   (param ?1 core.nat)
@@ -35,7 +37,7 @@ expression: "roundtrip(include_str!(\"../../hugr-model/tests/fixtures/model-para
   (param ?3 core.float)
   (core.fn [] []))
 
-(define-func example.call_literals (core.fn [] [])
+(define-func private example.call_literals (core.fn [] [])
   (dfg
     (signature (core.fn [] []))
     ((core.call
diff --git a/hugr-model/capnp/hugr-v0.capnp b/hugr-model/capnp/hugr-v0.capnp
index 6fbd03a58e..18a13f71b1 100644
--- a/hugr-model/capnp/hugr-v0.capnp
+++ b/hugr-model/capnp/hugr-v0.capnp
@@ -123,6 +123,7 @@ struct Param {
 }
 
 enum Visibility {
-    private @0;
-    public @1;
+    unspecified @0;
+    private @1;
+    public @2;
 }
diff --git a/hugr-model/src/capnp/hugr_v0_capnp.rs b/hugr-model/src/capnp/hugr_v0_capnp.rs
index 8723327acb..ec4e137acc 100644
--- a/hugr-model/src/capnp/hugr_v0_capnp.rs
+++ b/hugr-model/src/capnp/hugr_v0_capnp.rs
@@ -4524,8 +4524,9 @@ pub mod param {
 #[repr(u16)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Visibility {
-  Private = 0,
-  Public = 1,
+  Unspecified = 0,
+  Private = 1,
+  Public = 2,
 }
 
 impl ::capnp::introspect::Introspect for Visibility {
@@ -4538,8 +4539,9 @@ impl ::core::convert::TryFrom<u16> for Visibility {
   type Error = ::capnp::NotInSchema;
   fn try_from(value: u16) -> ::core::result::Result<Self, <Visibility as ::core::convert::TryFrom<u16>>::Error> {
     match value {
-      0 => ::core::result::Result::Ok(Self::Private),
-      1 => ::core::result::Result::Ok(Self::Public),
+      0 => ::core::result::Result::Ok(Self::Unspecified),
+      1 => ::core::result::Result::Ok(Self::Private),
+      2 => ::core::result::Result::Ok(Self::Public),
       n => ::core::result::Result::Err(::capnp::NotInSchema(n)),
     }
   }
@@ -4552,7 +4554,7 @@ impl ::capnp::traits::HasTypeId for Visibility {
   const TYPE_ID: u64 = 0x8d83_15f2_7a68_8301u64;
 }
 mod visibility {
-pub static ENCODED_NODE: [::capnp::Word; 26] = [
+pub static ENCODED_NODE: [::capnp::Word; 31] = [
   ::capnp::word(0, 0, 0, 0, 5, 0, 6, 0),
   ::capnp::word(1, 131, 104, 122, 242, 21, 131, 141),
   ::capnp::word(20, 0, 0, 0, 2, 0, 0, 0),
@@ -4562,7 +4564,7 @@ pub static ENCODED_NODE: [::capnp::Word; 26] = [
   ::capnp::word(21, 0, 0, 0, 250, 0, 0, 0),
   ::capnp::word(33, 0, 0, 0, 7, 0, 0, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
-  ::capnp::word(29, 0, 0, 0, 55, 0, 0, 0),
+  ::capnp::word(29, 0, 0, 0, 79, 0, 0, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
   ::capnp::word(99, 97, 112, 110, 112, 47, 104, 117),
@@ -4570,13 +4572,18 @@ pub static ENCODED_NODE: [::capnp::Word; 26] = [
   ::capnp::word(112, 110, 112, 58, 86, 105, 115, 105),
   ::capnp::word(98, 105, 108, 105, 116, 121, 0, 0),
   ::capnp::word(0, 0, 0, 0, 1, 0, 1, 0),
-  ::capnp::word(8, 0, 0, 0, 1, 0, 2, 0),
+  ::capnp::word(12, 0, 0, 0, 1, 0, 2, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
-  ::capnp::word(17, 0, 0, 0, 66, 0, 0, 0),
+  ::capnp::word(29, 0, 0, 0, 98, 0, 0, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
   ::capnp::word(1, 0, 0, 0, 0, 0, 0, 0),
-  ::capnp::word(9, 0, 0, 0, 58, 0, 0, 0),
+  ::capnp::word(25, 0, 0, 0, 66, 0, 0, 0),
+  ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
+  ::capnp::word(2, 0, 0, 0, 0, 0, 0, 0),
+  ::capnp::word(17, 0, 0, 0, 58, 0, 0, 0),
   ::capnp::word(0, 0, 0, 0, 0, 0, 0, 0),
+  ::capnp::word(117, 110, 115, 112, 101, 99, 105, 102),
+  ::capnp::word(105, 101, 100, 0, 0, 0, 0, 0),
   ::capnp::word(112, 114, 105, 118, 97, 116, 101, 0),
   ::capnp::word(112, 117, 98, 108, 105, 99, 0, 0),
 ];
diff --git a/hugr-model/src/v0/ast/hugr.pest b/hugr-model/src/v0/ast/hugr.pest
index 8c70ad4dc6..d960cb3a40 100644
--- a/hugr-model/src/v0/ast/hugr.pest
+++ b/hugr-model/src/v0/ast/hugr.pest
@@ -16,7 +16,8 @@ reserved = @{
   | "list"
   | "meta"
   | "signature"
-  | "pub"
+  | "public"
+  | "private"
   | "dfg"
   | "cfg"
   | "block"
@@ -80,7 +81,9 @@ node_cond              = { "(" ~ "cond" ~ port_lists? ~ signature? ~ meta* ~ reg
 node_import            = { "(" ~ "import" ~ symbol_name ~ meta* ~ ")" }
 node_custom            = { "(" ~ term ~ port_lists? ~ signature? ~ meta* ~ region* ~ ")" }
 
-symbol = { "pub"? ~ symbol_name ~ param* ~ where_clause* ~ term }
+visibility = { "public" | "private" }
+
+symbol = { visibility? ~ symbol_name ~ param* ~ where_clause* ~ term }
 
 signature    = { "(" ~ "signature" ~ term ~ ")" }
 param        = { "(" ~ "param" ~ term_var ~ term ~ ")" }
diff --git a/hugr-model/src/v0/ast/mod.rs b/hugr-model/src/v0/ast/mod.rs
index 51d327e544..b6e817b990 100644
--- a/hugr-model/src/v0/ast/mod.rs
+++ b/hugr-model/src/v0/ast/mod.rs
@@ -195,7 +195,7 @@ impl Operation {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Symbol {
     /// The visibility of the symbol.
-    pub visibility: Visibility,
+    pub visibility: Option<Visibility>,
     /// The name of the symbol.
     pub name: SymbolName,
     /// The parameters of the symbol.
diff --git a/hugr-model/src/v0/ast/parse.rs b/hugr-model/src/v0/ast/parse.rs
index 56fb2a0f22..a2c9a5cd9b 100644
--- a/hugr-model/src/v0/ast/parse.rs
+++ b/hugr-model/src/v0/ast/parse.rs
@@ -292,15 +292,16 @@ fn parse_param(pair: Pair<Rule>) -> ParseResult<Param> {
 
 fn parse_symbol(pair: Pair<Rule>) -> ParseResult<Symbol> {
     debug_assert_eq!(Rule::symbol, pair.as_rule());
-    // The optional "pub" in the grammar seems to disappear in the Rule, making this
-    // a bit hacky. If we defined a rule for visibility as a choice between different
-    // specifiers (i.e. pub / empty), then presumably we could avoid this `starts-with`.
-    let visibility = if pair.as_str().starts_with("pub") {
-        Visibility::Public
-    } else {
-        Visibility::Private
-    };
+
     let mut pairs = pair.into_inner();
+    let visibility = take_rule(&mut pairs, Rule::visibility)
+        .next()
+        .map(|pair| match pair.as_str() {
+            "public" => Ok(Visibility::Public),
+            "private" => Ok(Visibility::Private),
+            _ => unreachable!("Expected 'public' or 'private', got {}", pair.as_str()),
+        })
+        .transpose()?;
     let name = parse_symbol_name(pairs.next().unwrap())?;
     let params = parse_params(&mut pairs)?;
     let constraints = parse_constraints(&mut pairs)?;
diff --git a/hugr-model/src/v0/ast/print.rs b/hugr-model/src/v0/ast/print.rs
index 1db9a928bf..071146dedd 100644
--- a/hugr-model/src/v0/ast/print.rs
+++ b/hugr-model/src/v0/ast/print.rs
@@ -370,8 +370,9 @@ fn print_region<'a>(printer: &mut Printer<'a>, region: &'a Region) {
 
 fn print_symbol<'a>(printer: &mut Printer<'a>, symbol: &'a Symbol) {
     match symbol.visibility {
-        Visibility::Private => (),
-        Visibility::Public => printer.text("pub"),
+        None => (),
+        Some(Visibility::Private) => printer.text("private"),
+        Some(Visibility::Public) => printer.text("public"),
     }
 
     print_symbol_name(printer, &symbol.name);
diff --git a/hugr-model/src/v0/binary/read.rs b/hugr-model/src/v0/binary/read.rs
index c16c8f3b7d..08d7fed08a 100644
--- a/hugr-model/src/v0/binary/read.rs
+++ b/hugr-model/src/v0/binary/read.rs
@@ -190,6 +190,16 @@ fn read_region_scope(reader: hugr_capnp::region_scope::Reader) -> ReadResult<tab
     Ok(table::RegionScope { links, ports })
 }
 
+impl From<hugr_capnp::Visibility> for Option<model::Visibility> {
+    fn from(value: hugr_capnp::Visibility) -> Self {
+        match value {
+            hugr_capnp::Visibility::Unspecified => None,
+            hugr_capnp::Visibility::Private => Some(model::Visibility::Private),
+            hugr_capnp::Visibility::Public => Some(model::Visibility::Public),
+        }
+    }
+}
+
 /// (Only) if `constraints` are None, then they are read from the `reader`
 fn read_symbol<'a>(
     bump: &'a Bump,
@@ -197,11 +207,7 @@ fn read_symbol<'a>(
     constraints: Option<&'a [table::TermId]>,
 ) -> ReadResult<&'a mut table::Symbol<'a>> {
     let name = bump.alloc_str(reader.get_name()?.to_str()?);
-    let visibility = match reader.get_visibility() {
-        Ok(hugr_capnp::Visibility::Private) => model::Visibility::Private,
-        Ok(hugr_capnp::Visibility::Public) => model::Visibility::Public,
-        Err(_) => model::Visibility::default(),
-    };
+    let visibility = reader.get_visibility()?.into();
     let visibility = bump.alloc(visibility);
     let params = read_list!(bump, reader.get_params()?, read_param);
     let constraints = match constraints {
diff --git a/hugr-model/src/v0/binary/write.rs b/hugr-model/src/v0/binary/write.rs
index 02e40dd9b2..077de81079 100644
--- a/hugr-model/src/v0/binary/write.rs
+++ b/hugr-model/src/v0/binary/write.rs
@@ -110,10 +110,12 @@ fn write_operation(mut builder: hugr_capnp::operation::Builder, operation: &tabl
 
 fn write_symbol(mut builder: hugr_capnp::symbol::Builder, symbol: &table::Symbol) {
     builder.set_name(symbol.name);
-    builder.set_visibility(match symbol.visibility {
-        model::Visibility::Private => hugr_capnp::Visibility::Private,
-        model::Visibility::Public => hugr_capnp::Visibility::Public,
-    });
+    if let Some(vis) = symbol.visibility {
+        builder.set_visibility(match vis {
+            model::Visibility::Private => hugr_capnp::Visibility::Private,
+            model::Visibility::Public => hugr_capnp::Visibility::Public,
+        })
+    } // else, None -> use capnp default == Unspecified
     write_list!(builder, init_params, write_param, symbol.params);
     let _ = builder.set_constraints(table::TermId::unwrap_slice(symbol.constraints));
     builder.set_signature(symbol.signature.0);
diff --git a/hugr-model/src/v0/mod.rs b/hugr-model/src/v0/mod.rs
index 7ccefb3cde..78ae77f598 100644
--- a/hugr-model/src/v0/mod.rs
+++ b/hugr-model/src/v0/mod.rs
@@ -92,10 +92,9 @@ use std::sync::Arc;
 use table::LinkIndex;
 
 /// Describes how a function or symbol should be acted upon by a linker
-#[derive(Debug, Default, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord)]
 pub enum Visibility {
     /// The linker should ignore this function or symbol
-    #[default]
     Private,
     /// The linker should act upon this function or symbol
     Public,
diff --git a/hugr-model/src/v0/table/mod.rs b/hugr-model/src/v0/table/mod.rs
index f121499087..6ca6370f8f 100644
--- a/hugr-model/src/v0/table/mod.rs
+++ b/hugr-model/src/v0/table/mod.rs
@@ -304,7 +304,7 @@ pub struct RegionScope {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct Symbol<'a> {
     /// The visibility of the symbol.
-    pub visibility: &'a Visibility,
+    pub visibility: &'a Option<Visibility>,
     /// The name of the symbol.
     pub name: &'a str,
     /// The static parameters.
diff --git a/hugr-model/tests/fixtures/model-add.edn b/hugr-model/tests/fixtures/model-add.edn
index c0173ef5c8..5b02678744 100644
--- a/hugr-model/tests/fixtures/model-add.edn
+++ b/hugr-model/tests/fixtures/model-add.edn
@@ -3,6 +3,7 @@
 (mod)
 
 (define-func
+  public
   example.add
   (core.fn
     [(arithmetic.int.types.int 6) (arithmetic.int.types.int 6)]
diff --git a/hugr-model/tests/fixtures/model-call.edn b/hugr-model/tests/fixtures/model-call.edn
index 4bf2eaaac4..42b7fb24a8 100644
--- a/hugr-model/tests/fixtures/model-call.edn
+++ b/hugr-model/tests/fixtures/model-call.edn
@@ -2,13 +2,13 @@
 
 (mod)
 
-(declare-func
+(declare-func public
  example.callee
  (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])
  (meta (compat.meta_json "title" "\"Callee\""))
  (meta (compat.meta_json "description" "\"This is a function declaration.\"")))
 
-(define-func example.caller
+(define-func private example.caller
   (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])
   (meta (compat.meta_json "title" "\"Caller\""))
   (meta (compat.meta_json "description" "\"This defines a function that calls the function which we declared earlier.\""))
@@ -17,7 +17,7 @@
        ((core.call _ _ example.callee) [%3] [%4]
                                                  (signature (core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])))))
 
-(define-func
+(define-func private
   example.load
   (core.fn [] [(core.fn [arithmetic.int.types.int] [arithmetic.int.types.int])])
   (dfg
diff --git a/hugr-model/tests/fixtures/model-cfg.edn b/hugr-model/tests/fixtures/model-cfg.edn
index b105eb7d91..14a9a610fa 100644
--- a/hugr-model/tests/fixtures/model-cfg.edn
+++ b/hugr-model/tests/fixtures/model-cfg.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func example.cfg_loop
+(define-func private example.cfg_loop
   (param ?a core.type)
   (core.fn [?a] [?a])
   (dfg [%0] [%1]
@@ -18,7 +18,7 @@
             ((core.make_adt 0) [%4] [%5]
               (signature (core.fn [?a] [(core.adt [[?a] [?a]])])))))))))
 
-(define-func example.cfg_order
+(define-func public example.cfg_order
   (param ?a core.type)
   (core.fn [?a] [?a])
   (dfg [%0] [%1]
diff --git a/hugr-model/tests/fixtures/model-cond.edn b/hugr-model/tests/fixtures/model-cond.edn
index 65110fd67e..05905c1a5e 100644
--- a/hugr-model/tests/fixtures/model-cond.edn
+++ b/hugr-model/tests/fixtures/model-cond.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func
+(define-func private
   example.cond
   (core.fn
     [(core.adt [[] []]) (arithmetic.int.types.int 6)]
diff --git a/hugr-model/tests/fixtures/model-const.edn b/hugr-model/tests/fixtures/model-const.edn
index 5d9bcb49b4..959afe2ef4 100644
--- a/hugr-model/tests/fixtures/model-const.edn
+++ b/hugr-model/tests/fixtures/model-const.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func example.bools
+(define-func public example.bools
   (core.fn []
            [(core.adt [[] []]) (core.adt [[] []])])
   (dfg [] [%false %true]
@@ -12,7 +12,7 @@
        ((core.load_const (core.const.adt 1 (tuple))) [] [%true]
                                                                (signature (core.fn [] [(core.adt [[] []])])))))
 
-(define-func example.make-pair
+(define-func public example.make-pair
   (core.fn []
            [(core.adt
              [[(collections.array.array 5 (arithmetic.int.types.int 6))
@@ -45,7 +45,7 @@
         [[(collections.array.array 5 (arithmetic.int.types.int 6))
           arithmetic.float.types.float64]])])))))
 
-(define-func example.f64-json
+(define-func public example.f64-json
   (core.fn []
            [arithmetic.float.types.float64])
   (dfg [] [%0 %1]
diff --git a/hugr-model/tests/fixtures/model-constraints.edn b/hugr-model/tests/fixtures/model-constraints.edn
index 6884e55936..761a33c058 100644
--- a/hugr-model/tests/fixtures/model-constraints.edn
+++ b/hugr-model/tests/fixtures/model-constraints.edn
@@ -2,13 +2,14 @@
 
 (mod)
 
-(declare-func array.replicate
+(declare-func private array.replicate
               (param ?n core.nat)
               (param ?t core.type)
               (where (core.nonlinear ?t))
               (core.fn [?t] [(collections.array.array ?n ?t)]))
 
 (declare-func
+ public
  array.copy
  (param ?n core.nat)
  (param ?t core.type)
@@ -18,7 +19,7 @@
   [(collections.array.array ?n ?t)
    (collections.array.array ?n ?t)]))
 
-(define-func util.copy
+(define-func public util.copy
   (param ?t core.type)
   (where (core.nonlinear ?t))
   (core.fn [?t] [?t ?t])
diff --git a/hugr-model/tests/fixtures/model-entrypoint.edn b/hugr-model/tests/fixtures/model-entrypoint.edn
index b95cb06992..f75d8f7a5c 100644
--- a/hugr-model/tests/fixtures/model-entrypoint.edn
+++ b/hugr-model/tests/fixtures/model-entrypoint.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func main
+(define-func public main
   (core.fn [] [])
   (meta core.entrypoint)
   (dfg [] []
@@ -10,7 +10,7 @@
 
 (mod)
 
-(define-func wrapper_dfg
+(define-func private wrapper_dfg
   (core.fn [] [])
   (dfg [] []
     (signature (core.fn [] []))
@@ -18,7 +18,7 @@
 
 (mod)
 
-(define-func wrapper_cfg
+(define-func public wrapper_cfg
   (core.fn [] [])
   (dfg [] []
     (signature (core.fn [] []))
diff --git a/hugr-model/tests/fixtures/model-loop.edn b/hugr-model/tests/fixtures/model-loop.edn
index 5c4a6779e3..8276ed74ba 100644
--- a/hugr-model/tests/fixtures/model-loop.edn
+++ b/hugr-model/tests/fixtures/model-loop.edn
@@ -2,7 +2,9 @@
 
 (mod)
 
-(define-func example.loop
+(define-func
+  private
+  example.loop
   (param ?a core.type)
   (core.fn [?a] [?a])
   (dfg [%0] [%1]
diff --git a/hugr-model/tests/fixtures/model-order.edn b/hugr-model/tests/fixtures/model-order.edn
index 57cae40b86..4a00015a1f 100644
--- a/hugr-model/tests/fixtures/model-order.edn
+++ b/hugr-model/tests/fixtures/model-order.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func main
+(define-func public main
   (core.fn
     [(arithmetic.int.types.int 6)
       (arithmetic.int.types.int 6)
diff --git a/hugr-model/tests/fixtures/model-params.edn b/hugr-model/tests/fixtures/model-params.edn
index 48fb200886..c4e29f933c 100644
--- a/hugr-model/tests/fixtures/model-params.edn
+++ b/hugr-model/tests/fixtures/model-params.edn
@@ -2,7 +2,7 @@
 
 (mod)
 
-(define-func example.swap
+(define-func public example.swap
   ; The types of the values to be swapped are passed as implicit parameters.
   (param ?a core.type)
   (param ?b core.type)
@@ -10,14 +10,14 @@
   (dfg [%a %b] [%b %a]
        (signature (core.fn [?a ?b] [?b ?a]))))
 
-(declare-func example.literals
+(declare-func public example.literals
   (param ?a core.str)
   (param ?b core.nat)
   (param ?c core.bytes)
   (param ?d core.float)
   (core.fn [] []))
 
-(define-func example.call_literals
+(define-func private example.call_literals
   (core.fn [] [])
   (dfg [] []
     (signature (core.fn [] []))