allowed updating only specific fields