Hi David,
We do provide some configuration macros to provide a set of attributes that cannot be changed once set, and furthermore you can enforce certain values using either submit transforms (to override user-given values) or submit requirements (to enforce that users set certain values). The config macros of note are the four starting here:
I know these don't really solve the question of how to whitelist attributes, can you maybe describe a little more about the scenario that you're trying to solve or prevent?
Jason Patton