Security: Persist changed properties only when saving a changed business object record

Hello James,

This behavior is standard for XPO and is not related to the Security System. When an object is saved, a query that includes all persistent properties is sent to a database.
If you are concerned about the security (e.g. that it is possible to modify a read-only property in code and write these changes to the database), use the Integrated or Middle-Tier security instead of the UI-Level security. These modes will not allow changing read-only properties in code. Refer to the New Security System topic for additional information.

In addition, XPO provides the following ways to exclude some properties from the INSERT and UPDATE queries:

1. Use the FetchOnly attribute, as described in the following blog post: XPO - Easy Way to Map a Property to a Read-Only Database Column (v18.2).
2. Make these properties delayed and pass True to the DelayedAttribute.UpdateModifiedOnly parameter.
3. Create a Session's descendant and override its GetPropertiesListForUpdateInsert method. Here is an example of how to do this in an XAF application that uses the Integrated Security (SecuredObjectSpaceProvider):

C#
XpoDefault.TrackPropertiesModifications = true;  
winApplication.CreateCustomObjectSpaceProvider += (sender, e) => {  
    e.ObjectSpaceProvider = new MySecuredObjectSpaceProvider((ISelectDataSecurityProvider)winApplication.Security, e.ConnectionString, e.Connection, false);  
};  
...  
public class MySecuredObjectSpaceProvider : SecuredObjectSpaceProvider {  
    private ISelectDataSecurityProvider selectDataSecurityProvider;  
    public MySecuredObjectSpaceProvider(ISelectDataSecurityProvider provider, string connectionString, IDbConnection connection, bool threadSafe)  
        : base(provider, connectionString, connection, threadSafe) {  
            selectDataSecurityProvider = provider;  
    }  
    protected override UnitOfWork CreateDirectUnitOfWork(IDataLayer dataLayer) {  
        return new MyUnitOfWork(dataLayer);  
    }  
    //Prior to 17.2  
    //protected override UnitOfWork CreateUnitOfWork(IDataLayer dataLayer) {  
    //    UnitOfWork directBaseUow = new MyUnitOfWork(dataLayer);  
    //    SessionObjectLayer currentObjectLayer = new SecuredSessionObjectLayer(AllowICommandChannelDoWithSecurityContext, directBaseUow, true, null, new SecurityRuleProvider(XPDictionary, selectDataSecurityProvider.CreateSelectDataSecurity()), null);  
    //    return new MyUnitOfWork(currentObjectLayer, directBaseUow);  
    //}  
}  
public class MyUnitOfWork : UnitOfWork {  
    public MyUnitOfWork(IDataLayer dataLayer) : base(dataLayer) { }  
    public MyUnitOfWork(IObjectLayer objectLayer, params IDisposable[] disposeOnDisconnect) : base(objectLayer, disposeOnDisconnect) { }  
    protected override MemberInfoCollection GetPropertiesListForUpdateInsert(object theObject, bool isUpdate, bool addDelayedReference) {  
        MemberInfoCollection defaultMembers = base.GetPropertiesListForUpdateInsert(theObject, isUpdate, addDelayedReference);  
        if (TrackPropertiesModifications && isUpdate) {  
            MemberInfoCollection members = new MemberInfoCollection(GetClassInfo(theObject));  
            foreach (XPMemberInfo member in defaultMembers) {  
                if (member.GetModified(theObject)) {  
                    members.Add(member);  
                }  
            }  
            return members;  
        } else {  
            return defaultMembers;  
        }  
    }  
}  

Note that I have not tested this example in complex scenarios and do not guarantee that it works properly there.
See more examples in the How to customize the UnitOfWork behavior in XPO-based XAF applications article.