title: How to restrict properties for a domain being set from params
body: <p>I've got several properties in my domain class. However, I only want few of them to be set via the <code>params</code> object. What is a good way to do this?</p>
  
  <p>Example:</p>
  
  <p>Domain</p>
  
  <pre><code>class Color {
    String name
    String shade //don't want this set by params
  }
  </code></pre>
  
  <p>controller</p>
  
  <pre><code>class ColorController { 
    def save() {
       json {
         def c = new Color(params?.color)
         c.save(flush: true)
         //..more code
       }
    }
  }
  </code></pre>
  
  <p>If someone sends a request like:</p>
  
  <pre><code>  {"color": 
      {name: "red",
       shade: "light"
      }
    }
  </code></pre>
  
  <p>then user can change the <code>shade</code> property. How can I stop this?</p>