Field security and change log on new record

Kinetic 2023.1.8 Public Cloud
I have a UD field in the Customer table, with field security and change logging (data directive) in place. Both work fine for existing customers (update record). But they don’t work when creating a new customer (insert record). What do you think?

  1. Yep, that’s how it works. Field security and change log are performed upon update not insert.
  2. Sounds indicative of poorly configured field security and change log.

If #1, maybe I can do a work around like assigning a default value to the restricted field, regardless of what the user entered. Though that might be just another ignored data directive.
If #2, any idea what setting I missed?

#1. It’s called Change Log and is not a real logging service as one assumes. It does not record deletes either.

You can vote on the improvement at the Epicor Idea Site.