I need the ability to restrict the mutation of individual properties on a resource object.

Ex: John is allowed to update Foo.bar and Foo.baz, but Jane is only allowed to update Foo.bar

Is there any way to accomplish this in Keycloak? Perhaps with a javascript policy enforcer that checks the payload of a PUT against a list of fine grained scopes (foo:bar:update, foo:baz:update) or something along those lines?