Permission Set to Restrict Access to Managed Package Specific Custom Metadata

Question

We have a managed packaged that ships with a Custom Metadata property and an "Editor" that allows users to modify the Custom Metadata fields and create new ones.

We would like to include a permission set that restricts the modify functionality (Create/Update, we can't do delete from Apex Custom Metadata Deploy) and allows users to still "Read" the metadata.

Under Permission Sets, I see the the "System Permission": Modify Metadata (Beta if enabled without Modify All Data) which states:

Create, edit, and delete org metadata. Users must have appropriate access rights to the metadata they're trying to modify. Some metadata currently requires the Modify All Data permission, so some update attempts can fail if a user doesn't also have the Modify All Data permission

However, this seems to be a "general" grant (as in the user can modify any metadata record they want) so long as they have "Modify All Data" depending on the type?

Under Permission Set > Object, only the default tab-view for a Custom Metadata record can be given permissions.

Should we just create a clone VF page with restricted access for the modify operations? Is there another way around this?

Custom permissions seems to be specifically for Connected Apps access and do not execute any "Custom" code correct?

Answer 1

You can use Custom Permissions pretty much however you please. If that means you want to open up part of your UI for users with a certain permission, that is absolutely a valid use case. I have used them dozens of times and never once was it related to Connected Apps.

One piece of advice: across the entire ecosystem, permissions are additive, never restrictive. I highly recommend you have your Custom Permission tell you CanEditMyCustomMetadata as a whitelist, rather than CannotEditMyCustomMetadata as a blacklist.