For every API endpoint that creates or updates data, maintain an explicit allowlist of the fields it is permitted to accept and write. Any field not on the list is silently ignored — or returns a 400 error.

For a user profile update endpoint, the allowlist might be: [name, bio, profilePhoto, timezone]. Anything else — isAdmin, role, balance — is rejected at the API layer before it ever reaches the database.

A blocklist says "reject these specific fields." It fails the moment a developer adds a new sensitive field to the model and forgets to add it to the list. New sensitive fields are automatically blocked only if they're explicitly listed — which they won't be on day one.

An allowlist says "accept only these specific fields." New fields are blocked by default. The developer must actively decide to allow a field — which forces the security question to be asked at the moment the field is created.

An allowlist only controls what's accepted on write. It doesn't control what's returned on read. You need MIT 05 and MIT 06 to address the read side.