company and company_id attributes on protected entities are readonly