title: Prevent updated_at and created_at from being hacked in postgresql
body: <p>Let's say I have:<br />
  <strong>posts</strong></p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>id</th>
  <th>created_at</th>
  <th>updated_at</th>
  <th>...</th>
  </tr>
  </thead>
  </table>
  </div>
  <p>The default value for <strong>created_at</strong> is <code>now()</code>, and I have a trigger for <strong>updated_at</strong> like so:</p>
  <pre class="lang-sql prettyprint-override"><code>create trigger posts_updated_at before update on posts 
  for each row execute procedure moddatetime (updated_at);
  </code></pre>
  <p>How do I prevent everyone from updating the dates manually?</p>
  <ul>
  <li>created_at</li>
  <li>updated_at</li>
  </ul>
  <p>I imagine there is a standard way to protect these field (column level security maybe)?</p>
  <p>Something like this...</p>
  <pre class="lang-sql prettyprint-override"><code>CREATE POLICY no_date_change ON posts
      FOR UPDATE
      USING (created_at === created_at);
  </code></pre>
  <p>Either <code>created_at does not change</code> or <code>created_at before = created_at after</code>?</p>
  <p>What is the standard way to protect these fields?</p>
  <p>J</p>