//
// make sure read-only properties aren't modified from the
// outside (can still be mutable inside)
//
boolean readOnly = metadata.isReadOnlyExternal(qname);
PropertyChangeApprover security = new ExternalChangeApprover(qname, readOnly);
security.setSecurityToken(getSecurityToken());
addChangeApprover(security);
//
// if we can't update, we're either appendable (insert only)
// or constant (read only). we need an enforcer!