Universal Containers has expanded to sell virtual containers for data storage. Virtual container work orders are provisioned immediately by the…

The most secure and optimal approach among the choices to prevent a user from editing a record is to control their object-level permissions. Removing the 'Edit' permission for the Work Order object from the Sales Representative's profile (or a permission set) fundamentally revokes their ability to modify any Work Order record, regardless of status or type. This aligns with the requirement that work orders cannot be changed by them. While this approach affects all work orders, it is the only option provided that enforces a true inability to edit at the data level, which is critical for a system-provisioned, unchangeable record.

A. Implement a sharing rule that changes access for all Work Orders to Read.

Sharing rules are used to grant wider access to records than the organization-wide defaults allow; they cannot be used to restrict access.

B. Change the Record Type/Page Layout assignment for Work Orders to Read Only.

A read-only page layout is a user interface control, not a security control. A user with the 'Edit' object permission can still modify the record through other means, such as the API or inline editing on a list view.

1. Object Permissions (Profiles and Permission Sets):

Salesforce Security Guide, "Control Access to Objects". This guide details that object permissions, controlled via profiles and permission sets, are the primary way to specify what users can do with records of a particular object (e.g., create, read, edit, delete). Removing the "Edit" permission is the direct method to prevent record modification.

2. Sharing Rules:

Salesforce Security Guide, "Sharing Rules". This section explicitly states, "Use sharing rules to extend sharing access to users in public groups, roles, or territories. Sharing rules give particular users greater access by making automatic exceptions to your organization-wide sharing settings." This confirms they are for extending, not restricting, access.

3. Page Layouts vs. Security:

Salesforce Help, "Page Layouts". The documentation describes page layouts as a tool to "control the layout and organization of buttons, fields, s-controls, Visualforce, custom links, and related lists on object record pages." It also notes you can make fields read-only, but this does not override the fundamental object permissions a user has.