It’s easy enough to block users from updating a field; there’s a flag on the field’s Security tab for that very purpose. Here’s a trick that lets you be a bit more subtle though: rather than blocking users altogether and making a field read-only, it allows a blank field to be written to but then prevents any further updates.

It uses lookup.ini and a ‘shadow’ field. In this example, usector is the field that I wish to protect and userdef01 is my shadow field:


[autoupdate]
usector=userdef01, usector
userdef01=usector

[userdef01]
otherwise=&contact2->usector
overwrite=0

[usector]
otherwise=&contact2->userdef01
overwrite=1


It’s quite simple. Any change to usector will cause userdef01 to take the new contents of usector, but only if userdef01 is empty. The contents of userdef01 are then copied back to usector. If userdef01 already contained a value then it won’t have been updated and so the previous value will be copied back to usector.

If userdef01 is made invisible to the ordinary user, but is made visible to (say) a manager, then the manager can update usector by entering a new value into userdef01. I called this a shadow field earlier but you could also think of it as the ‘management override’ field.