A create form can prefill values from fields the user is not allowed to read

"Duplicate as draft" and "create from template" endpoints often load the source record, copy every column into the new draft, and return that payload to the create form. Field-level read rules on the detail page never run on that path, because the handler treats the copy as an internal write.

Casey can create invoices and can open the public notes on Invoice 88, but cannot read the "internal cost" field. Choosing "Create from Invoice 88" still fills the new draft's cost input with 4800. Casey never saw that number on the detail page, yet the prefill API handed it over in the form JSON.

When you build a create-from-source or template prefill, run the acting user's field read check on each source field before you copy it into the draft or the form response. Skip fields they cannot read. Prefer an empty default over leaking a restricted value into a writable input.

Quick test: as a user who can create records and read only public fields on a source, call the prefill endpoint for that source. The response must omit every restricted field, and the create form must not show those values already filled in.