I want to block edit and delete rights for certain custom objects in my managed package for all users in subscriber orgs. I would be okay if admins bypassed this (i.e. I can live with admins having Modify All). What's important to me is achieving this in a seamless manner (i.e. as invisible to the installer as possible).
I think I have a few ways, each having their own short-coming:
I will need a post-install script to assign to all users. But what about users that are created afterwards? I think that still requires manual assignments.
For the scenario described above using profiles is not recommended by Salesforce. But let's say I went with profiles; first, admins will be able to overwrite them and second, how would I manage cloned profiles?
Overridden View/Edit action buttons
This will only work through the UI. The back-end still leaves my objects unprotected.
This isn't the most user-friendly option, but works otherwise.
I believe the combination of triggers and page overrides pretty much does what I need (except for not removing Edit/Del links on related lists which is within tolerance), however I feel as though this is the job of Permission Sets and Profiles. What is the proper way to do this?
Btw in case you are wondering about data cleanup; I have Apex taking care of that through a VF page.