If a class is accepting or returning mutable components, then it should consider defensive copy of these components. If copy is costly and class trusts its clients then defensive copy may be replaced by documentation outlining the client's repsonsibility not to modify the affected components.