The key/value/tokens properties can be set internal write, I think the user should not change them without the model's APIs, and we can implement an IReadOnlyAssertion interface for the assertion that only read the properties. This change will be included in #124.