use hiera to set default class parameters in the module - but don't make them changeable in each hiera file

I like the idea to set class parameter defaults in a hiera yaml file included in the module. *But this allows users to change the class defaults from using any yaml file in the hierarchie.* I don't want to expose the default values. I want to use a role/profile pattern and expose a much smaller set of parameters to the 'user'. The 'user' being able to change parameter defaults values circumvents the encapsulation promised by the role/profile pattern. I don't want to set all class parameters in each profile declaring a certain class. If there is a good default value it should be set just once. This is puzzling me quiet a bit. I would welcome an replies or comments. How do you handle this? Just by rule/convention? cheers