But when the model is accessed from four different controllers representing different privilege levels (e.g. public profile page, user settings page, internal admin page) and user experiences, is it really still the model's job to figure out which incoming updates are allowed to update which fields?
This is "thin controllers" gone too far -- the model shouldn't have to figure out where it's being updated from and what to allow.
This is "thin controllers" gone too far -- the model shouldn't have to figure out where it's being updated from and what to allow.