Grails Data Binding: Controlling Nested Association Binding per Endpoint

Goal

Determine whether nested association binding (e.g., author.name) should be permitted for a given request endpoint, given that Grails enables deep binding by default.

Constraints and Uncertainty

• The bindable static constraint acts as an allowlist/blocklist for top‑level properties but its effect on nested property paths is not explicitly documented for all versions.
• Command objects with the Validateable trait provide request‑scoped validation, yet they inherit the same deep‑binding behavior unless explicitly restricted.
• Allowing unrestricted nested binding can expose mass‑assignment risks on ownership or version fields when association identifiers are user‑controlled.

Open Questions

1. Should nested binding be disabled globally, or is a per‑controller allowlist the recommended approach?
2. How does the bindable constraint interact with dotted property paths in Grails 4.x and later?
3. What pattern ensures legitimate association lookups (by id) while preventing unintended deep property updates?