I think building protections against mass assignment is best done on the entity. Doing it during the save makes it much harder to effectively handle the now invalid entity state. Whitelisting at save also gets ugly with associated data.