The pre-existing logic was ugly and too aware of apps, but I'm worried that this will leak through fields which we don't intend to be editable (e.g., published_by). Did you do something to blacklist those or filter them?