Stamp server-controlled fields at save time — never by mutating ``request.data``. DRF's contract: ``post()`` → ``create()`` → ``serializer.is_valid()`` → ``perform_create(serializer)`` → ``serializer.save(**kwargs)``. Server values belong in that final ``save(**kwargs)`` — they override ``validated_data``, never pass through client validation, and don't need to be *writable* serializer fields. The matching serializer field becomes ``read_only=True`` (or is dropped from ``fields``), shrinking — not widening — the mass-assignment surface, and the immutable-``QueryDict`` (multipart) failure mode of the old ``request.data[...] =`` pattern disappears. Declare the fields to stamp as ``field -> fn(view) -> value`` maps:: class ExperimentV2sView(ServerStampedFieldsMixin, ...): create_stamped_fields = {"created_by": stamp_request_user_id} # + serializer: created_by = ...(read_only=True) FK columns: when the stamped value is an ``int`` and the field names a relation on the serializer's ``Meta.model``, the kwarg is rewritten to ``<field>_id`` so ``Model.objects.create`` accepts it (a raw ``int`` on the FK attribute itself would raise). Non-relation fields (``scorer`` = email) and instance values pass through unchanged. Cooperative composition: subclasses that need to stamp *additional* server values (e.g. ``OrganizationInjectionMixin`` stamping org/project) override ``get_create_save_kwargs`` / ``get_update_save_kwargs`` and merge onto ``super()`` — yielding exactly ONE ``serializer.save()`` per request (calling ``save()`` twice would re-run create/update side effects).