We have a managed packaged that ships with a Custom Metadata property and an "Editor" that allows users to modify the Custom Metadata fields and create new ones.
We would like to include a permission set that restricts the modify functionality (Create/Update, we can't do delete from Apex Custom Metadata Deploy) and allows users to still "Read" the metadata.
Under Permission Sets, I see the the "System Permission":
Modify Metadata (Beta if enabled without Modify All Data) which states:
Create, edit, and delete org metadata. Users must have appropriate access rights to the metadata they're trying to modify. Some metadata currently requires the Modify All Data permission, so some update attempts can fail if a user doesn't also have the Modify All Data permission
However, this seems to be a "general" grant (as in the user can modify any metadata record they want) so long as they have "Modify All Data" depending on the type?
Permission Set > Object, only the default tab-view for a Custom Metadata record can be given permissions.
Should we just create a clone VF page with restricted access for the modify operations? Is there another way around this?
Custom permissions seems to be specifically for Connected Apps access and do not execute any "Custom" code correct?