I am used to working in very secure environments and so I design my permissions to a very fine degree of granularity. One thing that I normally do is to explicitly
DENY users the ability to
UPDATE columns that should never be updated.
create table dbo.something ( created_by varchar(50) not null, created_on datetimeoffset not null );
These two columns should never be changed once the value has been set. Therefore I would explicitly
UPDATE permission on them.
Recently, during a team meeting a developer raised the point that the logic to ensure the fields never get updated should be contained within the application layer and not the database layer in the event that "they need to update the values for some reason". To me that sounds like typical dev mentality (I know, I used to be one!)
I am the senior architect at my company and I have always worked on the principle of least amount of privileges required to get the app to work. All permissions are audited regularly.
What is the best practice in this scenario?