You could do something like that, but a lot of it will depend on how you have your whole sharing/security model set up (e.g., what org-wide defaults, profiles, sharing rules, and also role-hierarchy) and the relationship among the users that can and cannot check the checkbox.
Check out the Objects, Fields, Page Layouts, and Security section on the Developer Force Documentation site. After you read the documentation you may see that using different features of the sharing model will better satisfy whatever you're trying to do.
I'm making a lot of assumptions about your org here, so this answer could be way off, but at the least it can get you thinking about the different concepts along with reading the documentation.
I'm illustrating this with just two simple profiles, you might have more profiles, existing profiles, permission sets, etc. This answer just sets what fields will show up as available on the page layout, so if the user has some other way to edit the fields this wouldn't address that.
Two profiles for the two different types of users:
- Allower - Can check the 'Allow' checkbox - Visible/edit for the Allow checkbox Field-Level Security (FLS) on the Contact.
- User - Cannot check the 'Allow' checkbox. - Read-only for the FLS on the Allow checkbox.
Create two page layouts:
- All Fields
- Limited Fields - All fields that you don't want edited are marked as read only. Various buttons would not be available, etc.
Create two record types:
- Not Allowed
Create two workflow rules to update the record type field on the Contact:
- Set the record type of the Contact to Allowed when the checkbox is saved as true.
- Set the record type of the Contact to Not Allowed when the checkbox is saved as false.
Set up the Page Layout Assignments as follows:
Profile Allower: Allowed Record and Not Allowed Record both get assigned the All Fields layout. This enables the Allower to always see all fields, including the checkbox.
Profile User: Allowed Record gets All Fields Layout (FLS still prevents changing the checkbox, though), but Not Allowed Record gets Limited Fields layout.
You can use a criteria based sharing rule on the Contact. If this works for you it is simpler and more thorough than my Answer 1, so I'd go with it.
- Set public Read-Only org-wide default for the Contact. (if it is private then you might have to create an additional rule based on whatever you are doing to give read access)
- Share it with a criteria based rule to make it Public Read/Write to a Group that includes the users/roles/etc that you want to open it up to.
- You still need the Field-Level Security (FLS) to prevent them from checking the box, though. Also, keep in mind that if a Contact is not connected to an Account it is private and will not be seen by others. Also the users will still see the edit button, but when they click it they'll get redirected to a page that has an "Insufficient Privileges" message.