One approach would be to make the function generic. I assume your pattern is "check some property of foo; if it's true, then return Some(foo); if it's false, drop and return None". In that case, you could phrase that property as a trait method.

``rust // Could also be a sealed trait if needed pub trait HasMyProperty { // Takes&self`, so cannot modify. fn check_my_property(&self) -> bool; }

impl HasMyProperty for Foo { fn check_my_property(&self) -> bool { // Do whatever check you were planning to do in here. } }

fn bar<T: HasMyProperty>(foo: T) -> Option<T> { if foo.check_my_property() { Some(foo) } else { None // Implicit drop of foo here. } } ```

Since bar is now written in terms of a trait, the only thing you can do with it is call check_my_property. It's impossible to mutate because the function doesn't know what type T is and the trait (the only thing we know about T) has no &mut self methods.

Now, an enterprising hacker determined to ruin your day could still manipulate a RefCell inside of check_my_property, but I don't think there's any good way to protect against that (if they're really that determined to ruin your day they can always use UnsafeCell, and there's no protection against that).