Phalcon definitely doesn't take into account column priveleges but dynamic update might help. You can set it for every model individually or set it in the Models Manager DI service to make it global:
$di->setShared(
"modelsManager",
function () use ($di) {
$modelsManager = new \Phalcon\Mvc\Model\Manager();
$eventsManager = $di->getShared("eventsManager");
$eventsManager->attach(
"modelsManager:afterInitialize",
function(\Phalcon\Events\Event $event, \Phalcon\Mvc\Model\ManagerInterface $modelsManager, \Phalcon\Mvc\ModelInterface $model) {
$modelsManager->useDynamicUpdate($model, true);
}
);
$modelsManager->setEventsManager($eventsManager);
return $modelsManager;
}
);
You can also use my Composer package (sidroberts/phalcon-events) which has the event as a class (see https://github.com/SidRoberts/phalcon-events/blob/master/src/ModelsManager/ModelDynamicUpdate.php):
$di->setShared(
"modelsManager",
function () use ($di) {
$modelsManager = new \Phalcon\Mvc\Model\Manager();
$eventsManager = $di->getShared("eventsManager");
$eventsManager->attach("modelsManager", new \Sid\Phalcon\Events\ModelsManager\ModelDynamicUpdate());
$modelsManager->setEventsManager($eventsManager);
return $modelsManager;
}
);
Obivously, you'll still run into nasty problems if you update a column that is priveleged but that should work.