If you can implement this requirement as a table check constraint, then that would perhaps be the best solution, because it would involve no programming work arounds. For example, let's assume that the column in question is an enrollment status code that is logically tied to enrolled_date and disenrolled_date columns.

check

(

(disenrolled_date is null and enrolled_status = 'E')

or (disenrolled_date is not null and enrolled_status = 'D')

)

If the application should NEVER update this specific column, only insert rows and perhaps update other columns, then you can DENY UPDATE on the column to the application account.

deny update on

( [column] ) to ;