did not have write access to what, exactly
The ShipHead, SipDtl, etc tables.
You put field security on every field in those tables?
Yup. Wasn’t hard to do once I figured out how.
If you don’t want them entering shipments, why would you give them access to shipment entry at all?
I was testing how well the field security works.
So on that pack you created, if you go back and try to modify one of the fields you put security on, like say the tracking number, it shouldn’t let you save the change. If you are using kinetic, it will LOOK like you can but it won’t actually save. That is your field security. It doesn’t apply to processes like mass ship.
It let me create a line and enter all of the data needed to save the line just using all of the button searches. Yes, I can’t actually enter anything directly in the fields, but I was able to get around that.
Now you’re getting into service level security
Epicor security levels…
Yep, that’s how it works.
Would you care to elaborate? Are you saying field security only works on edits?
Field security only works on the bound field itself. A lot of what is happening in kinetic when you are creating records is that the epicor business objects are filling in a dataset behind the scenes, you aren’t directly updating a field. Like in shipment entry, you don’t type in the part number, you select the order, line, and release, and epicor fills in the part number. Field security doesn’t get involved. But later if you try to go edit the part number, you can’t, assuming you put read-only field security on it At least that is how it worked in classic. In kinetic all the fields remain open for editing and field security is only enforced when you try to save the record, which can get really confusing. I opened a problem for this years ago but haven’t heard when it will be fixed. PRB0276842
Thanks for the expanded explanation.
Grids might take first place for the most broken part of kinetic, but security certainly gets an honorable mention..
Field security is also a double edged sword. If I want to automate something with a BPM I want my code to be able to make an update, but not the user. But the code is running under the users permissions, so you can’t do that. So many use cases make field security worthless.
You can, but you’ll have to impersonate, which brings its own issues.
I wanted the 
emoji, but that one isn’t one the reactions.
This is a critically important perspective. “Field security” is a misnomer. It’s securing input objects, not the fields they’re bound to.
That’s my stance on ‘Field Security’. If an input object is the securable, it’s relevant. If the field is the securable, do something else.