My solution I have proposed plenty, is attribute invalidation.

So the caller sees a more restricted set, depending upon the callback
passed in.

However Timon didn't like that, thought it wasn't good enough.