Please hear me out completely. I am trying to create a profile where user can read data (= export) from Data Loader, but NOT insert/edit/delete ANYTHING back through it. So I created a profile with Salesforce license type, gave access to Data Loader, set all Object Settings to 'Read' and stripped several System Permissions (for Events, Tasks etc).
The problem? When I login via Data Loader as that profile user, attempt to 'Insert' and check the box 'Show all Salesforce objects', I get a ton of system objects like 'Share', 'Tag', in addition to User, Attachment, CaseComment, Email Template, Folder, Vote, etc (this list is far from exhaustive).
How can I strip insert/edit/delete access for EVERY object out there, especially 'Salesforce objects', so this profile is as naked as possible when viewed from DataLoader?
Can the Data Loader itself be restricted to show 'Export' option ONLY and remove all other options?