title: DDD and C# - Restricting access to child entity
body: <p>I am almost certain I have overlooked something simple, but it hasn't clicked. </p>
  
  <p>I have a Person entity (root of Person aggregate). I also have a child entity for Authentication and Authorization (Auth) which has List of Roles and List of Permissions.</p>
  
  <p>I want modifications to Roles and Permissions to be managed through the root, using AddAuthRole, etc. methods on the root.</p>
  
  <p>This is fairly straightforward, but how would I go about doing this while not exposing any similar functionality in the Auth entity? I do not want consumers using a ref to the child to try to Add and Remove against these lists.</p>
  
  <p>I have a feeling that this is some basic OO concept that I should be ashamed to be unaware of...</p>