Control record locks and system protection
Purpose
Administrators need to protect sensitive records or individual details without creating an irreversible trap. This capability distinguishes a customer's reversible lock from Rhythm's protected system configuration and records authorized lock changes. It keeps restrictions meaningful across record saves, deletion, and owned-element handling rather than treating a lock as an editable checkbox.
How It Works
Contacts, organizations, and contact roles expose lock and unlock actions with separate administrator permissions. A change supplies the read version and a nonblank reason, advances the record version, and appends actor, time, and before-and-after values to the lock audit. Repeating the current state produces no audit or record change.
A full lock blocks ordinary updates and deletion; a delete lock allows corrections but prevents removal. Owned-element locks constrain changes and removal independently of the parent. An audited unlock can release all or selected element locks, and an unknown element refuses the whole request. The narrower ordinary-save path for clearing an element lock still requires unlock authority and cannot combine other changes to that locked element.
Ordinary contact and organization writes cannot alter parent locks. Contact-role writes retain their specified delete-lock behavior, while full changes use the audited actions. Protected system records refuse customer lock, unlock, and delete actions even when the caller holds the keys, but ordinary fields remain editable. No seeded CRM record currently carries that protection. Other classification types enforce locks without exposing these audited actions yet.
Example
An administrator locks Ruth's contact against deletion while leaving ordinary corrections possible, recording why retention is needed. Later she reads the current version and unlocks it with a reason. The audit identifies both decisions. If a phone element remains locked, she can explicitly release that element through the supported unlock action; a nonexistent element identity refuses the request without releasing any locks.
Ruth's delete lock leaves her coordinator able to correct an ordinary phone, but the same coordinator cannot release the lock merely by returning a different lock value in the contact payload. The administrator uses the authorized action with the version she read. If another change advanced that version, she rereads before deciding whether release is still appropriate. A request naming one known phone and one unknown element releases neither. Reading the lock audit afterwards connects the successful state changes with their reasons and actors; repeating an already-applied state supplies no additional audit event.
Why It Works This Way
Our reading is that reversible customer protection needs an authorized route that can operate despite the restriction it is releasing. Otherwise a full lock becomes permanent by accident. Separate keys and required reasons make release accountable rather than letting any record editor weaken protection. Version checks stop an administrator from changing a restriction based on outdated information.
System protection expresses a different authority and therefore cannot be bypassed by customer unlock permission. Element safeguards prevent deleting or editing through the parent from circumventing a child restriction. Reorders can move locked catalogue entries because ordering the shared list differs from changing their protected content. Missing actions on other types and the absence of protected seeds remain boundaries, not evidence that those types are freely unlockable or that seed-protection policy is decided.
Relationships
Save corrections without overwriting another change and Remove records and their owned information enforce locks during ordinary mutations. Archive respects update locks. Inspect a record’s changes over time captures contact and organization changes, while the lock audit records its own focused decisions. Platform security evaluates permissions; Rhythm's protected-record mechanism remains outside customer administration authority.