title: Yii2: How to make an attribute of an ActiveRecord object read-only from the outside?
body: <p>I would like to ask this in general. But I think the <a href="http://www.yiiframework.com/doc-2.0/yii-behaviors-blameablebehavior.html" rel="nofollow">BlameableBehavior</a> and the <a href="http://www.yiiframework.com/doc-2.0/yii-behaviors-timestampbehavior.html" rel="nofollow">TimestampBevavior</a> could be good examples where this is needed:</p>
  
  <p>What would I have to do so that an attribute can only be read but not modified from the outside of an ActiveRecord object? In certain cases it should be modified internally, like it is required by the mentioned Behaviors. But never from the outside. How can this be achived? With <a href="http://www.yiiframework.com/doc-2.0/guide-input-validation.html" rel="nofollow">validation rules</a>? With overridden setters? Reverting attributes on update events?</p>
  
  <p><strong>Example</strong></p>
  
  
  
  <p>This should work as expected, since it is part of the class and is considered as 'internal':</p>
  
  <pre class="lang-php prettyprint-override"><code>/**
   * @property integer $created_by
   * @property integer $updated_by
   */
  class Item extends ActiveRecord {
  
      public function behaviors() {
          return [
              [
                  'class'              =&gt; BlameableBehavior::className(),
                  'createdByAttribute' =&gt; 'created_by',
                  'updatedByAttribute' =&gt; 'updated_by',
              ],
          ];
      }
  }
  </code></pre>
  
  <p>This shouldn't be possible. How ever it gets accomplised:</p>
  
  <pre class="lang-php prettyprint-override"><code>$item-&gt;created_by = $user-&gt;id;
  $item-&gt;save();
  </code></pre>
  
  <p>At least it shouldn't have any effect.</p>
  
  <p>This example uses the Behavior, but it can be thought for any other attribute.</p>