FC5 — CREATING a record over the wire while a field is create-denied SUCCEEDS, with the value
silently dropped so the column takes its database default (test-plan 3.11).
WHY THIS CHECK EXISTS. The client builds the mutation INPUT by calling entity.Get() on every
writable field, and Get() throws for a read-denied one. On an UPDATE the field is already
NotLoaded (the server stripped it from the load) so it never reaches that loop, but a NEW
record carries no such marking — so creating a record on an entity with any denied field
failed outright, over the wire only, while every server-transport check stayed green. Manual
Explorer testing found it; this is the executable form.
The write identity is the seeded MULTI user: it holds the Writer role (so entity-level create
is allowed) plus the Denier role, whose Phone rule this bundle tightens to Allow/Deny/Deny.
That is the only combination that can reach field-level create suppression at all — a
read-only identity is refused by the entity gate long before FLS is consulted.
FC5 — CREATING a record over the wire while a field is create-denied SUCCEEDS, with the value silently dropped so the column takes its database default (test-plan 3.11).
WHY THIS CHECK EXISTS. The client builds the mutation INPUT by calling
entity.Get()on every writable field, andGet()throws for a read-denied one. On an UPDATE the field is already NotLoaded (the server stripped it from the load) so it never reaches that loop, but a NEW record carries no such marking — so creating a record on an entity with any denied field failed outright, over the wire only, while every server-transport check stayed green. Manual Explorer testing found it; this is the executable form.The write identity is the seeded MULTI user: it holds the Writer role (so entity-level create is allowed) plus the Denier role, whose Phone rule this bundle tightens to Allow/Deny/Deny. That is the only combination that can reach field-level create suppression at all — a read-only identity is refused by the entity gate long before FLS is consulted.