I once implemented the "command pattern" in order to have undo in my app. Basically you have to ensure that you only modify your model from command objects, and never directly from UI callbacks. To ensure this, I created a decorator that walked the stack, and asserted that the call originated in a subclass of `Command`. Then I wrapped all setters on the model with this decorator. This was really helpful during development for weeding out cases where Undo didn't work correctly. In the release, you could disable the check so there would be no performance penalty.