What is overposting or mass assignment, and how would you prevent it in an API?

In production I treat each write model as an explicit command rather than a mirror of the persistence entity. Mapping sets ownership, tenant, price, role, audit, and workflow fields from trusted server context, then domain validation checks the resulting state. PATCH formats use an allowlist of paths and reject attempts to traverse into protected or nested members. Contract tests submit forbidden fields, unknown properties, explicit nulls, and old client payloads. Logs can record rejected field names, but never echo sensitive submitted values.