Ability to Lock Models/Blocks from UI Edits

[theo.benoit16]

Hey team,

I’ve built a package to define fields, models, and blocks programmatically within source code, rather than relying on manual changes in the CMS UI. It’s working well so far, but to fully enforce consistency and avoid accidental changes through the CMS interface, I’d love to propose a small but powerful feature:

The ability to “lock” models and blocks so they can only be modified via the API, not through the UI.

This could take the form of a flag or metadata field on models/blocks that signals they’re managed by code, effectively disabling UI-based editing. It would really help enforce a single source of truth and protect against misalignments between code and CMS config.

Would love to hear your thoughts or if there’s something similar already in the works!

[roger]

Hey @theo.benoit16,

I believe this can be accomplished using our roles & permissions system.

For example:

1. Create a new role called “Read-only”. Give it only the permission to access certain environments:
   

   
   
   Then click “Save role” at the upper right.

2. After it saves, scroll down and click the “Change permissions for records and assets” button near the bottom:

   

3. There, add a new model-based permission with the “Role can VIEW” permission:

   

4. Assign one or more collaborators to that role.

Then that collaborator can see that model’s records, but not edit anything:

---

Please note that this applies to entire records or models at once. You cannot selectively apply it to individual fields or blocks.

Does that help?

[theo.benoit16]

Hi!

I am not sure this help, this would « lock » the record of a model.
What I need is to lock the definition of models/blocks.

The records can be changed etc…
The point would be to have a single source of truth to modify the schema of models/blocks

[roger]

Ah, sorry I misunderstood, @theo.benoit16!

In that case, you can remove the “Create/edit models and plugins” permission from their role:

Then they won’t be able to edit the schema. Your API key can have it own role that can do whatever is needed.

Does that do it?