How to check the update operation on doc's attachment in SyncFunction?

I want to do some acl(no one can modify the attachment) about attachment update operation, so I want to know that in SyncFunction, how to check the update operation on attachment?
This is my way:
step 1: check if(oldDoc == null), If this condition is false(update operation), then
step 2: If doc has element named _attachments(New docs included attachment),then
step 3: If the _attachments array is chanegd,then throw({forbidden: “No one can change the _attachments”});
Is this step right? Is there a better way to check the update operation on attachment?