---
title: "Accept only the fields you expect · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/access-control/mass-assignment
id: APS-21
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 778
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Accept only the fields you expect

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Access control](https://agentwranglers.se/playbook/application-security/access-control.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-21
- Level: Required
- Chapter: [Access control](https://agentwranglers.se/playbook/application-security/access-control.md)
- Rule: Copy only named fields from a request into a record. Never save the whole request body.
- Check: Update a test user's profile with an extra `"role": "admin"` field. The role stays the same.
- Risk: An account or system taken over
- How: List the fields each form or API may change. Ignore or reject the rest. Keep fields such as `role`, `price` and `owner_id` out of every list a user can reach.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
// Bad
await db.users.update(id, req.body);
// Good
const { name, phone } = req.body;
await db.users.update(id, { name, phone });
```

### Python example

```python
# Python: copy named fields only
changes = {field: body[field] for field in ("name", "phone") if field in body}
users.update(user_id, changes)
```

### PHP example

```php
// PHP with Laravel
$user->update($request->only(['name', 'phone']));
```

## Sources

- [OWASP Mass Assignment Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)

## Related rules

- API-12 [Accept only fields you know](https://agentwranglers.se/playbook/api-design/requests-and-responses/strict-input.md) in API design
- API-13 [Say which format PATCH accepts](https://agentwranglers.se/playbook/api-design/requests-and-responses/patch-format.md) in API design
- API-50 [Mark server-set fields read-only and secrets write-only](https://agentwranglers.se/playbook/api-design/contracts-and-docs/read-only-fields.md) in API design
- DSK-11 [Check the sender and content of every message to the main process](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/validate-ipc.md) in Desktop apps and extensions

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/access-control/mass-assignment">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Decide access in one policy module](https://agentwranglers.se/playbook/application-security/access-control/policy-decision-point.md)
- Next: [Return only the fields needed](https://agentwranglers.se/playbook/application-security/access-control/only-needed-fields.md)
- [Access control](https://agentwranglers.se/playbook/application-security/access-control.md)