yii2/docs/model.md

Model

Validation rules and mass assignment

In Yii2 unlike Yii 1.x validation rules are separated from mass assignment. Validation rules are described in rules() method of the model while what's safe for mass assignment is described in scenarios method:

function rules() {
 return array(
  // rule applied when corresponding field is "safe"
  array('username', 'length', 'min' => 2),
  array('first_name', 'length', 'min' => 2),
  array('password', 'required'),

  // rule applied when scenario is "signup" no matter if field is "safe" or not
  array('hashcode', 'check', 'on' => 'signup'),
 );
}

function scenarios() {
 return array(
  // on signup allow mass assignment of username
  'signup' => array('username', 'password'),
  'update' => array('username', 'first_name'),
 );
}

Note that everything is unsafe by default and you can't make field "safe" without specifying scenario.