diff --git a/admin/openapi/admin.json b/admin/openapi/admin.json
index f1f0bc98..b84d472c 100644
--- a/admin/openapi/admin.json
+++ b/admin/openapi/admin.json
@@ -2301,6 +2301,25 @@
                 ],
                 "type": "object"
             },
+            "cabana.PermissionRecordLock": {
+                "properties": {
+                    "code": {
+                        "type": "string"
+                    },
+                    "note": {
+                        "type": "string"
+                    },
+                    "value": {
+                        "type": "integer"
+                    }
+                },
+                "required": [
+                    "code",
+                    "note",
+                    "value"
+                ],
+                "type": "object"
+            },
             "cabana.RecordAction": {
                 "properties": {
                     "confirm": {
@@ -2361,6 +2380,16 @@
                         },
                         "type": "array"
                     },
+                    "permissionLocks": {
+                        "additionalProperties": {
+                            "items": {
+                                "$ref": "#/components/schemas/cabana.PermissionRecordLock"
+                            },
+                            "type": "array"
+                        },
+                        "description": "PermissionLocks are, per permissioneditor field, the permissions this\nrecord fixes (the controller's PermissionRecordLockProvider), with the\nvalue to show and the note, translated in the request locale. The show\nand save responses carry it; it is omitted when no record lock applies\nand is never part of the form schema.",
+                        "type": "object"
+                    },
                     "title": {
                         "description": "Title is the controller's record title (pact.FormRecordTitle), omitted\nwhen the controller names none.",
                         "type": "string"
@@ -5936,7 +5965,7 @@
                 ]
             },
             "get": {
-                "description": "meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered.",
+                "description": "meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered. meta.permissionLocks maps a `type: permissioneditor` field to the permissions this record fixes (the controller's cabana.PermissionRecordLockProvider), each with code, value (1, -1, or 0 for inherit) and note (localized): the admin shows that value and the note on the row and never sends the code; it is absent when no record lock applies.",
                 "parameters": [
                     {
                         "description": "Vendor",
@@ -6028,7 +6057,7 @@
                 ]
             },
             "put": {
-                "description": "A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise.",
+                "description": "A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise. A record-locked permission (meta.permissionLocks) keeps its stored value when its code is absent from the body; a present value that differs from the stored one is a 403 on the field. The response carries meta.permissionLocks like the show route.",
                 "parameters": [
                     {
                         "description": "Vendor",
diff --git a/admin/src/api/schema.d.ts b/admin/src/api/schema.d.ts
index 4478fc4e..8d114b10 100644
--- a/admin/src/api/schema.d.ts
+++ b/admin/src/api/schema.d.ts
@@ -2666,7 +2666,7 @@ export interface paths {
         };
         /**
          * Show an admin record
-         * @description meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered.
+         * @description meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered. meta.permissionLocks maps a `type: permissioneditor` field to the permissions this record fixes (the controller's cabana.PermissionRecordLockProvider), each with code, value (1, -1, or 0 for inherit) and note (localized): the admin shows that value and the note on the row and never sends the code; it is absent when no record lock applies.
          */
         get: {
             parameters: {
@@ -2726,7 +2726,7 @@ export interface paths {
         };
         /**
          * Update an admin record
-         * @description A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise.
+         * @description A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise. A record-locked permission (meta.permissionLocks) keeps its stored value when its code is absent from the body; a present value that differs from the stored one is a 403 on the field. The response carries meta.permissionLocks like the show route.
          */
         put: {
             parameters: {
@@ -6138,6 +6138,11 @@ export interface components {
             locked?: boolean;
             tab?: string;
         };
+        "cabana.PermissionRecordLock": {
+            code: string;
+            note: string;
+            value: number;
+        };
         "cabana.RecordAction": {
             confirm?: string;
             /**
@@ -6158,6 +6163,16 @@ export interface components {
                 [key: string]: components["schemas"]["cabana.RelationOption"][];
             };
             notices?: components["schemas"]["cabana.FieldNotice"][];
+            /**
+             * @description PermissionLocks are, per permissioneditor field, the permissions this
+             *     record fixes (the controller's PermissionRecordLockProvider), with the
+             *     value to show and the note, translated in the request locale. The show
+             *     and save responses carry it; it is omitted when no record lock applies
+             *     and is never part of the form schema.
+             */
+            permissionLocks?: {
+                [key: string]: components["schemas"]["cabana.PermissionRecordLock"][];
+            };
             /**
              * @description Title is the controller's record title (pact.FormRecordTitle), omitted
              *     when the controller names none.
diff --git a/admin/src/api/types.ts b/admin/src/api/types.ts
index bddefcef..c9cc0be6 100644
--- a/admin/src/api/types.ts
+++ b/admin/src/api/types.ts
@@ -41,6 +41,8 @@ export type FormRedirects = Schemas['cabana.FormRedirects']
 export type FormPreview = Schemas['cabana.FormPreview']
 export type FieldPreset = Schemas['cabana.FieldPreset']
 export type PermissionOption = Schemas['cabana.PermissionOption']
+/** A permission a stored record fixes (meta.permissionLocks): the value and note to show. */
+export type PermissionRecordLock = Schemas['cabana.PermissionRecordLock']
 export type RelationSchema = Schemas['cabana.RelationSchema']
 export type RelationMessages = Schemas['cabana.RelationMessages']
 export type RelationMutationResult = Schemas['cabana.RelationMutationResult']
diff --git a/admin/src/components/form/control.ts b/admin/src/components/form/control.ts
index bd92f616..6fee7280 100644
--- a/admin/src/components/form/control.ts
+++ b/admin/src/components/form/control.ts
@@ -72,15 +72,24 @@ export function toggleValue(current: unknown, on: boolean): boolean | number {
  * A permissioneditor value as it may be sent (UI-SPEC S5): only codes the
  * field's options offer, with a value of the mode's set. Radio keeps 1
  * (allow) and -1 (deny) and leaves an inherited code out; checkbox keeps 1.
- * A stored code that is not offered is never sent: the server keeps it.
+ * A stored code that is not offered is never sent: the server keeps it. A
+ * code in `locked` (the record's permission locks, D-21) is never sent
+ * either: the server keeps its stored value.
  */
-export function permissionValues(field: FormField, value: unknown): Record<string, number> {
+export function permissionValues(
+  field: FormField,
+  value: unknown,
+  locked?: ReadonlySet<string>,
+): Record<string, number> {
   const out: Record<string, number> = {}
   if (value === null || typeof value !== 'object' || Array.isArray(value)) {
     return out
   }
   const stored = value as Record<string, unknown>
   for (const option of field.permissionOptions ?? []) {
+    if (locked?.has(option.code)) {
+      continue
+    }
     const n = Number(stored[option.code])
     if (n === 1 || (field.mode === 'radio' && n === -1)) {
       out[option.code] = n
diff --git a/admin/src/components/form/fields/PermissionEditorField.vue b/admin/src/components/form/fields/PermissionEditorField.vue
index 60673661..1b2cac4d 100644
--- a/admin/src/components/form/fields/PermissionEditorField.vue
+++ b/admin/src/components/form/fields/PermissionEditorField.vue
@@ -1,10 +1,11 @@
 <script setup lang="ts">
-import { computed } from 'vue'
+import { computed, inject } from 'vue'
 import { CheckboxIndicator, CheckboxRoot, RadioGroupItem, RadioGroupRoot } from 'reka-ui'
 import { Check, Lock } from '@lucide/vue'
-import type { PermissionOption } from '../../../api/types'
+import type { PermissionOption, PermissionRecordLock } from '../../../api/types'
 import { t } from '../../../app/i18n'
 import { controlAttributes, permissionValues, type FieldControlProps } from '../control'
+import { FORM_PERMISSION_LOCKS } from '../formContext'
 
 // Permission editor (UI-SPEC S5, D-16). The options come with the form
 // schema, already filtered and marked for the signed-in administrator. They
@@ -13,10 +14,21 @@ import { controlAttributes, permissionValues, type FieldControlProps } from '../
 // permission; checkbox mode edits allow (1). The value is an object of code
 // to integer holding only offered codes: a stored code that is not offered is
 // kept by the server and never sent. A locked row shows its stored value and
-// cannot change; the server refuses a changed locked code anyway.
+// cannot change; the server refuses a changed locked code anyway. A row the
+// record fixes (meta.permissionLocks, D-21) shows the lock's value and note
+// instead, wins over a request lock, and is never sent.
 const props = defineProps<FieldControlProps>()
 const emit = defineEmits<{ 'update:modelValue': [value: Record<string, number>] }>()
 
+const allLocks = inject(FORM_PERMISSION_LOCKS, null)
+const recordLocks = computed(() => {
+  const out = new Map<string, PermissionRecordLock>()
+  for (const lock of allLocks?.value[props.field.name] ?? []) {
+    out.set(lock.code, lock)
+  }
+  return out
+})
+
 interface Section {
   key: string
   label: string
@@ -75,16 +87,29 @@ function rowId(sectionIndex: number, optionIndex: number): string {
   return `${props.controlId}-${sectionIndex}-${optionIndex}`
 }
 
+function recordLock(option: PermissionOption): PermissionRecordLock | undefined {
+  return recordLocks.value.get(option.code)
+}
+
 function disabled(option: PermissionOption): boolean {
-  return readOnly.value || !!option.locked
+  return readOnly.value || !!option.locked || recordLock(option) !== undefined
 }
 
 /** Whether the row shows the lock icon and text: never on a read-only screen. */
 function showsLock(option: PermissionOption): boolean {
-  return !!option.locked && !readOnly.value
+  return (!!option.locked || recordLock(option) !== undefined) && !readOnly.value
+}
+
+/** The lock note of a row: the record lock's note wins over the request lock's. */
+function lockNote(option: PermissionOption): string {
+  return recordLock(option)?.note || t('backend::lang.permissioneditor.locked')
 }
 
 function valueOf(option: PermissionOption): number {
+  const lock = recordLock(option)
+  if (lock) {
+    return lock.value === 1 || (radio.value && lock.value === -1) ? lock.value : 0
+  }
   return current.value[option.code] ?? 0
 }
 
@@ -145,6 +170,7 @@ function set(option: PermissionOption, value: number): void {
         :key="option.code"
         :data-permission="option.code"
         :data-locked="showsLock(option) ? '' : undefined"
+        :data-locked-by="showsLock(option) && recordLock(option) ? 'record' : undefined"
         class="flex min-h-[56px] items-center justify-between gap-x-4 gap-y-2 border-t border-border px-4 py-3 max-sm:flex-col max-sm:items-start"
       >
         <div class="flex min-w-0 flex-col">
@@ -163,7 +189,7 @@ function set(option: PermissionOption, value: number): void {
             class="text-[13px] text-muted [overflow-wrap:anywhere]"
             data-permission-locked
           >
-            {{ t('backend::lang.permissioneditor.locked') }}
+            {{ lockNote(option) }}
           </p>
           <p
             v-else-if="option.comment"
diff --git a/admin/src/components/form/formContext.ts b/admin/src/components/form/formContext.ts
index 2c84b32f..c33f9c88 100644
--- a/admin/src/components/form/formContext.ts
+++ b/admin/src/components/form/formContext.ts
@@ -5,7 +5,7 @@
 // provider (settings pages) gets the defaults of the injecting control.
 import { ref, type InjectionKey, type Ref } from 'vue'
 import type { FileRoutes } from '../../api/files'
-import type { AdminDependentOptionsResult, AdminRecord, FormField } from '../../api/types'
+import type { AdminDependentOptionsResult, AdminRecord, FormField, PermissionRecordLock } from '../../api/types'
 
 /** Read-only view of the form's current values. */
 export const FORM_VALUES: InjectionKey<Readonly<Ref<AdminRecord>>> = Symbol('summer.form.values')
@@ -90,6 +90,15 @@ export const FORM_SESSION: InjectionKey<FormSession> = Symbol('summer.form.sessi
  */
 export const SETTINGS_SECRETS: InjectionKey<Readonly<Ref<Record<string, string>>>> = Symbol('summer.settings.secrets')
 
+/**
+ * The record's permission locks (meta.permissionLocks, D-21): per
+ * permissioneditor field name, the codes the stored record fixes with the
+ * value and note to show. FormView and PreviewView provide it from the record
+ * response; a control without a provider sees no record lock.
+ */
+export const FORM_PERMISSION_LOCKS: InjectionKey<Readonly<Ref<Record<string, PermissionRecordLock[]>>>> =
+  Symbol('summer.form.permissionLocks')
+
 /** Event a widget element dispatches to run its action (bubbles, composed). */
 export const WIDGET_EVENT = 'summer-action'
 
diff --git a/admin/src/components/form/formState.ts b/admin/src/components/form/formState.ts
index 58655779..a5a00867 100644
--- a/admin/src/components/form/formState.ts
+++ b/admin/src/components/form/formState.ts
@@ -1,6 +1,6 @@
 // Helpers shared by the record form and the settings form: context
 // filtering, the save payload, 422 detail mapping and focus.
-import type { AdminRecord, ErrorBody, FieldNotice, FormField } from '../../api/types'
+import type { AdminRecord, ErrorBody, FieldNotice, FormField, PermissionRecordLock } from '../../api/types'
 import { permissionValues } from './control'
 import { isMLField, localeRecord } from './mlLocale'
 import { isRegisteredField } from './registry'
@@ -48,9 +48,16 @@ export function contextAllows(field: FormField, mode: FormMode): boolean {
  * The save body: values keyed by field name for every editable field that
  * has a value. Read-only fields and types without a renderer are never sent.
  * An empty password on update means "unchanged" and is left out; on create it
- * is sent as entered and the server's rules decide (UI-SPEC S7).
+ * is sent as entered and the server's rules decide (UI-SPEC S7). `locks` are
+ * the record's permission locks (meta.permissionLocks): their codes are left
+ * out of each permissioneditor value.
  */
-export function editablePayload(fields: FormField[], values: AdminRecord, mode: FormMode = 'create'): AdminRecord {
+export function editablePayload(
+  fields: FormField[],
+  values: AdminRecord,
+  mode: FormMode = 'create',
+  locks?: Readonly<Record<string, readonly PermissionRecordLock[]>>,
+): AdminRecord {
   const out: AdminRecord = {}
   for (const field of fields) {
     if (field.readOnly || !isRegisteredField(field)) {
@@ -62,7 +69,8 @@ export function editablePayload(fields: FormField[], values: AdminRecord, mode:
     }
     if (field.type === 'permissioneditor') {
       // Sent whenever it is shown, reduced to offered codes and values.
-      out[field.name] = permissionValues(field, value)
+      const locked = locks?.[field.name]
+      out[field.name] = permissionValues(field, value, locked ? new Set(locked.map((lock) => lock.code)) : undefined)
       continue
     }
     if (isMLField(field)) {
diff --git a/admin/src/views/FormView.vue b/admin/src/views/FormView.vue
index 4da54404..261db3ab 100644
--- a/admin/src/views/FormView.vue
+++ b/admin/src/views/FormView.vue
@@ -20,6 +20,7 @@ import {
   FORM_FEEDBACK,
   FORM_LOCALE,
   FORM_PATCH,
+  FORM_PERMISSION_LOCKS,
   FORM_SESSION,
   FORM_VALUES,
   createUploadGate,
@@ -78,6 +79,9 @@ const recordId = mode === 'update' ? Number(route.params.id) : null
 const schema = ref<FormView | null>(null)
 const values = ref<AdminRecord>({})
 const labels = ref<RecordMeta['labels']>({})
+// The record's permission locks (meta.permissionLocks, D-21): codes the
+// stored record fixes; they are shown locked and never sent.
+const permissionLocks = ref<NonNullable<RecordMeta['permissionLocks']>>({})
 /** The controller's record title (meta.title, pact.FormRecordTitle); '' when it names none. */
 const recordTitle = ref('')
 const errors = ref<Record<string, string[]>>({})
@@ -205,7 +209,7 @@ const dirty = computed(
     !loading.value &&
     (pendingChanges.value > 0 ||
       activeUploads.value > 0 ||
-      snapshot(editablePayload(fields.value, values.value, mode)) !== saved.value),
+      snapshot(editablePayload(fields.value, values.value, mode, permissionLocks.value)) !== saved.value),
 )
 
 function adopt(record: RecordEnvelope | undefined): void {
@@ -221,9 +225,10 @@ function adopt(record: RecordEnvelope | undefined): void {
     }
     values.value = next
     labels.value = record.meta.labels ?? {}
+    permissionLocks.value = record.meta.permissionLocks ?? {}
     recordTitle.value = record.meta.title ?? ''
   }
-  saved.value = snapshot(editablePayload(fields.value, values.value, mode))
+  saved.value = snapshot(editablePayload(fields.value, values.value, mode, permissionLocks.value))
 }
 
 async function load(): Promise<void> {
@@ -316,6 +321,7 @@ provide(FORM_PATCH, update)
 provide(FORM_LOCALE, computed(() => schema.value?.meta.locale || currentLocale.value))
 provide(FORM_ENABLED_LOCALES, computed(() => schemaEnabledLocales(schema.value?.meta)))
 provide(FORM_ASSETS, () => assetsReady)
+provide(FORM_PERMISSION_LOCKS, computed(() => permissionLocks.value))
 // The form's single polite live region (dependent dropdown clears, repeater
 // moves) and the feedback nested controls read: errors and notices by row
 // path, the confirm dialog (Phase 17, D-07, D-08).
@@ -395,7 +401,7 @@ async function save(): Promise<RecordEnvelope | null> {
   forbidden.value = null
   notices.value = {}
   try {
-    const body = editablePayload(fields.value, values.value, mode)
+    const body = editablePayload(fields.value, values.value, mode, permissionLocks.value)
     const result =
       recordId === null
         ? await api.POST('/{vendor}/{plugin}/{controller}', { params: { path, header: sessionHeader }, body })
diff --git a/admin/src/views/PreviewView.vue b/admin/src/views/PreviewView.vue
index 76aff542..f64cc5bc 100644
--- a/admin/src/views/PreviewView.vue
+++ b/admin/src/views/PreviewView.vue
@@ -9,7 +9,7 @@ import { controllerIdFromParams, controllerPath } from '../app/controllerRoutes'
 import { message, t } from '../app/i18n'
 import { loadControllerAssets } from '../app/pluginAssets'
 import { newSessionKey } from '../app/sessionKey'
-import { FIELD_SCOPE, FORM_SESSION, createUploadGate } from '../components/form/formContext'
+import { FIELD_SCOPE, FORM_PERMISSION_LOCKS, FORM_SESSION, createUploadGate } from '../components/form/formContext'
 import FormTabs from '../components/form/FormTabs.vue'
 import PreviewField from '../components/form/PreviewField.vue'
 import RecordActions from '../components/form/RecordActions.vue'
@@ -54,6 +54,9 @@ const recordPath = `${listPath}/${recordId}`
 const schema = ref<FormView | null>(null)
 const values = ref<AdminRecord>({})
 const labels = ref<RecordMeta['labels']>({})
+// The record's permission locks (meta.permissionLocks): the preview shows
+// their values, without icon or note (read-only screen).
+const permissionLocks = ref<NonNullable<RecordMeta['permissionLocks']>>({})
 /** The controller's record title (meta.title, pact.FormRecordTitle); '' when it names none. */
 const recordTitle = ref('')
 const actions = ref<RecordAction[]>([])
@@ -150,6 +153,7 @@ async function loadRecord(): Promise<boolean> {
     }
     values.value = { ...result.data.data }
     labels.value = result.data.meta.labels ?? {}
+    permissionLocks.value = result.data.meta.permissionLocks ?? {}
     recordTitle.value = result.data.meta.title ?? ''
     actions.value = result.data.meta.actions ?? []
     return true
@@ -212,6 +216,7 @@ provide(FIELD_SCOPE, {
   values: computed(() => values.value),
   path: (name: string) => name,
 })
+provide(FORM_PERMISSION_LOCKS, computed(() => permissionLocks.value))
 provide(FORM_SESSION, {
   key: sessionKey,
   recordId,
diff --git a/docs/backend/forms.md b/docs/backend/forms.md
index 8e9d8fea..5a6f5e85 100644
--- a/docs/backend/forms.md
+++ b/docs/backend/forms.md
@@ -371,6 +371,33 @@ func (MembersController) AdminSetPermissionValues(_ context.Context, field strin
 - A save that does not send the field leaves the stored permissions alone, and the field's `context` applies as for any field.
 - The keys `options`, `default`, `nameFrom`, `emptyOption`, `relation` and `preset` are refused on the type. A field without `mode`, or on a controller that does not implement the provider, stops the start-up. The type is not available on settings forms or relation forms.
 
+### Permissions the record fixes
+
+Some values cannot change on one particular record: grants a plugin declares in code for a role apply whatever the role stores, and an administrator may not change their own overrides. The controller says so by also implementing `cabana.PermissionRecordLockProvider`. Its `AdminPermissionRecordLocks` returns, for a stored record, a list of `cabana.PermissionRecordLock`: the `Code`, the `Value` the editor shows (1, -1, or 0 for inherit) and a `Note` (a translation key or text). It is asked with the request's administrator, for a stored record only, never on a create. A roles controller locks the grants its plugins declare:
+
+```go src=modules/cabana/example_permission_record_locks_test.go#AccessRolesController.AdminPermissionRecordLocks
+// AdminPermissionRecordLocks shows the grants plugins declare for the role
+// as granted and locked, with a note: unticking them on the form would
+// change nothing.
+func (c AccessRolesController) AdminPermissionRecordLocks(_ context.Context, field string, record any) ([]cabana.PermissionRecordLock, error) {
+	role := record.(*AccessRole)
+	var locks []cabana.PermissionRecordLock
+	for _, code := range c.CodeGrants[role.Code] {
+		locks = append(locks, cabana.PermissionRecordLock{
+			Code:  code,
+			Value: 1,
+			Note:  "acme.access::lang.roles.granted_by_plugin",
+		})
+	}
+	return locks, nil
+}
+```
+
+- The record response (show, create and update) carries the locks as `meta.permissionLocks`, keyed by field name: `{"permissions": [{"code": "posts.edit", "value": 1, "note": "Granted to this role by a plugin. It cannot be removed here."}]}`, with the note translated in the request locale. The key is absent when no lock applies, and the form schema never carries it.
+- The admin shows a record-locked row with the lock's value, a disabled control, the lock icon and the note instead of the option's comment. A record lock wins over `Locked`. On a read-only screen (the preview) only the value is shown.
+- The admin never sends a record-locked code. On an update the server keeps the stored value of such a code when it is absent from the body; a present value must equal the stored one, otherwise the save is answered 403 `forbidden` on the field. The stored value is what `AdminPermissionValues` returns, so a role whose code grant is not in its stored permissions still saves, and the code is left out of the `Locked` comparison.
+- cabana's own Roles screen locks a role's code-declared grants with `backend::lang.permissioneditor.locked_by_code`, and the Administrators screen locks every override on the editor's own record with `backend::lang.permissioneditor.locked_self`.
+
 ## Markdown and multilingual fields
 
 `type: markdown` edits markdown source on a host text column. The admin SPA shows a source editor with a Preview toggle. When Preview opens, and again shortly after the source changes while it is open, the SPA posts the field's source (the active locale's text for `mlmarkdown`) to the preview route below and renders only the server's answer; when the output is refused it shows the server's message as text. The server renders through `cabana.RenderMarkdown`, which uses the pinned goldmark engine without unsafe HTML. Output that still contains a script or iframe tag, an event handler, or a javascript, vbscript or data URL is refused, so translated raw HTML cannot become executable preview content. `POST <prefix>/api/v1/markdown/preview` renders a `{markdown}` source through `cabana.RenderMarkdown` for any signed-in administrator and answers `{html}`, or a 422 `validation_failed` on `markdown` when the output is refused.
diff --git a/modules/cabana/README.md b/modules/cabana/README.md
index 15b26cf6..ef818717 100644
--- a/modules/cabana/README.md
+++ b/modules/cabana/README.md
@@ -38,7 +38,7 @@ Use cases:
 - Preview screen: a `preview` mapping in `config_form.yaml` (`preview: {}`, or with `headerPartial: <name>` for a status hint) gives the form a read-only record screen in the admin SPA. The form schema reports it as `preview` (`cabana.FormPreview`), fields with `context: preview` are shown only there and are never written by a save, `messages.preview` and `messages.edit` name the screen's subtitle and edit button, and `recordUrl` and the form redirects may point at it as `.../preview/:id`. An empty `preview:` key or an unknown key inside it fails boot.
 - Plugin field types: a plugin implementing `pact.HasFormFieldTypes` registers admin form field types under short aliases that any controller's `fields.yaml` uses as `type:`. Boot checks the aliases (no built-in type, no alias claimed by two plugins), the element prefix, the scripts and styles and each field's option keys and `CheckOptions`. A save runs the type's `Decode` inside the save transaction after the record is loaded: the decoded value is stored, a `pact.FormFieldError` is a 422 on the field, any other error an opaque 500, and the notices a type returns are localized into the response's `meta.notices` (`cabana.FieldNotice`), which is absent when no type reported anything. Show and save responses serve the value through the type's `Load`. A translatable type's value is a locale map stored through the same lift, `cabana.TranslationWriter` and hydrate path as `mlmarkdown`, decoded and loaded per locale. On update, a value equal to the one the form was served for that field and locale is neither decoded nor written. Form hooks read what a save wrote through `cabana.FieldWritesFromContext`. A list column may name a plugin alias as its `type` and shows the type's `ListValue`. The cabana-owned upload route hands an element's file to the type's `Upload`. The form schema carries `element`, `translatable` and `typeOptions` for such a field. Settings and relation forms refuse plugin field types (supported in controller forms only). See [Plugin field types](../../docs/backend/field-types.md).
 - Form-only fields: a controller implementing `pact.FormVirtualFields` lists fields of its `fields.yaml` that are not columns of the form. They are exempt from the column binding, never filled into the model and never part of a record response; the values an administrator submits reach the Form hooks through `cabana.VirtualFieldsFromContext`, only for fields whose `context` allows the operation, and a nested value is a 422 on the field. `type: password` is a masked field that must be listed this way, so a password is sent in a save body and never comes back. A controller implementing `pact.FormRules` supplies the validation rules per operation (`create` or `update`), which replace the model's `Rules()` for admin saves; a rule on a virtual field is checked against the submitted value, never against a model column of the same name. Neither is available on settings forms or relation forms.
-- Permission editor: a `type: permissioneditor` field with `mode: radio` (allow `1`, inherit, deny `-1`) or `mode: checkbox` (allow `1`) edits a record's permission set as a JSON object of code to integer. The controller implements `cabana.PermissionEditorProvider`: it returns the offered `cabana.PermissionOption` list per request (served on the field as `permissionOptions`, with `locked` for permissions the administrator may not change) and reads and stores the record's values, so the storage shape is the plugin's. A save answers 422 on the field for a value that is not an object of integers, a code that is not offered or a value outside the mode's set, and 403 `forbidden` when a locked code's value changes; stored codes that are not offered are kept. The widget fill contract is unchanged: a widget still writes scalar fields only.
+- Permission editor: a `type: permissioneditor` field with `mode: radio` (allow `1`, inherit, deny `-1`) or `mode: checkbox` (allow `1`) edits a record's permission set as a JSON object of code to integer. The controller implements `cabana.PermissionEditorProvider`: it returns the offered `cabana.PermissionOption` list per request (served on the field as `permissionOptions`, with `locked` for permissions the administrator may not change) and reads and stores the record's values, so the storage shape is the plugin's. A save answers 422 on the field for a value that is not an object of integers, a code that is not offered or a value outside the mode's set, and 403 `forbidden` when a locked code's value changes; stored codes that are not offered are kept. A controller that also implements `cabana.PermissionRecordLockProvider` fixes some values of one stored record (a role's code-declared grants, an administrator's own overrides): the record response carries them as `meta.permissionLocks`, the admin shows them locked with their note and never sends them, and a save keeps their stored values. The widget fill contract is unchanged: a widget still writes scalar fields only.
 - Markdown and multilingual fields: `type: markdown` edits source on a host text column; `cabana.RenderMarkdown` turns that source into HTML with the pinned goldmark engine and no unsafe HTML, and leftover script or iframe tags, event handlers, or javascript, vbscript or data URLs are rejected; the admin form preview renders through it via POST `/markdown/preview`. `type: mltext`, `type: mltextarea` and `type: mlmarkdown` take a JSON object of locale code to string; `mltextarea` is the multi-line variant and takes `size` like `textarea`. The form schema's `cabana.FormMeta.EnabledLocales` lists every enabled code when a `cabana.TranslationWriter` is published, default locale first and then the other enabled codes in the writer's order, so every ML control opens on the locale stored in the host columns; create seeds an empty string per code, and Show/save replace the host scalar with that map via `hydrateMLRecord` and `TranslationWriter.TranslatedExact` (missing non-default codes stay empty; D-11 fallback is not applied). A GET host string is merged onto the seed so sibling locales are not dropped. The default locale fills the host column; other locales reach a plugin-published `cabana.TranslationWriter` after the host row has a primary key, still inside the controller's permissioned save transaction. Relation-child create, update and show on `cabana.RelationService` use the same lift, apply and `hydrateMLRecord` path as controller save, still with no standalone translate-write route. An unknown field type, including an unknown `ml*` type, fails boot.
 - Rich text: `type: richeditor` edits HTML in a host text column (the admin SPA shows a WYSIWYG editor). It takes the common field keys plus `size`; any other key fails boot, and settings and relation forms refuse the type (supported in controller forms only). On create and update a submitted value must be a string or null (anything else is a 422 on the field) and is sanitized through [seaglass](../seaglass/README.md) before it is filled: HTML the policy keeps whole is stored byte for byte, otherwise the clean HTML is stored and what was removed is reported in `meta.notices` under the field (`backend::lang.richeditor.removed_elements`, `removed_attributes`, `removed_comments` with the count and names, or `markup_changed`).
 - Repeater: `type: repeater` edits a JSON list in one column (`lagoon.Jsonable`) with a nested `form.fields` of `text`, `textarea`, `number`, `checkbox`, `switch`, `dropdown` (static, method or `dependsOn` a field of the same row) and `richeditor` fields, plus `prompt`, `minItems`, `maxItems` and `titleFrom` (`cabana.RepeaterForm` in the schema; the span is always full). Other nested types, a nested repeater, nested `tab`, `context` or `preset`, and WinterCMS's `groups` and `style` fail boot; settings and relation forms refuse the type. A save decodes the rows before the projection: null is an empty list, anything but a list of objects is a 422 on the field, each row keeps only the nested names with scalars coerced per type, a required nested value missing in a row is a 422 under `field.index.nested`, the row bounds are 422s on the field (`repeater.max_items`, `repeater.min_items`), nested richeditor values are sanitized with notices under the row path, and nested dependent dropdowns are rechecked. Record responses carry the list of rows.
@@ -245,7 +245,7 @@ func (p *Plugin) AdminFS() fs.FS { return adminFS }
 | `cabana.CompileFormWithTypes` | `cabana.CompileForm` that also accepts the plugin field types of one plugin (`[]pact.FormFieldType`), with the boot checks of their aliases, option keys and `CheckOptions`. |
 | `cabana.FieldTypeAssets` / `cabana.FieldTypesResponse` | One entry of GET `/field-types` (`name`, `element`, `translatable`, `scripts`, `styles`) and the route's answer. |
 | `cabana.AdminFieldTypes` | Swag annotation of the field types route. |
-| `cabana.RecordMeta` | Meta of a record response: `labels` of relation fields, `actions` (show only) and `notices` (create and update only, omitted when empty). |
+| `cabana.RecordMeta` | Meta of a record response: `labels` of relation fields, `actions` (show only), `notices` (create and update only, omitted when empty) and `PermissionLocks` (`permissionLocks`: per permissioneditor field, the permissions the record fixes, omitted when none applies). |
 | `cabana.FieldNotice` | One entry of `meta.notices`: the `field`, the content `locale` of a translatable field type's value, and the localized `message` a field type's `Decode` reported. At most 10 per field and locale, each cut to 500 characters. |
 | `cabana.ListSchema` / `cabana.FormSchema` / `cabana.RelationSchema` | Locale-neutral compiled schemas; each request works on a localized copy. |
 | `cabana.CompiledController` | One controller after compilation: list, form, relations and writable fields. |
@@ -307,6 +307,8 @@ func (p *Plugin) AdminFS() fs.FS { return adminFS }
 | `cabana.FieldUploadResponse` / `cabana.AdminFieldUpload` | Answer (`url`) and swag annotation of the field upload route. |
 | `cabana.PermissionOption` | One permission a `type: permissioneditor` field offers: code, label, optional tab and comment, and `Locked`. |
 | `cabana.PermissionEditorProvider` | Controller capability behind a `type: permissioneditor` field: `AdminPermissionOptions`, `AdminPermissionValues` and `AdminSetPermissionValues`. |
+| `cabana.PermissionRecordLock` | One permission a stored record fixes: `Code`, the `Value` the editor shows (1, -1, or 0 for inherit) and a `Note` (phrase key or text). |
+| `cabana.PermissionRecordLockProvider` | Optional controller capability next to `PermissionEditorProvider`: `AdminPermissionRecordLocks` returns a stored record's locked permissions; they travel as `meta.permissionLocks`, are never sent by the admin, and a save keeps their stored values (403 when a present value differs). |
 | `cabana.FormMeta` | Form (and optional list) schema meta: `Locale` is the UI locale of the response; `EnabledLocales` lists content locales for ML fields when a `cabana.TranslationWriter` is published, default locale first and then the other enabled codes in the writer's order (`json:"enabledLocales,omitempty"` so list schemas omit the key). |
 | `cabana.TranslationWriter` | Optional plugin-published service that persists non-default locale values during a host save and reads exact stored translations through `TranslatedExact`. Cabana never imports a translate plugin; writes run only inside the permissioned, scoped save transaction after the host row has a primary key, including relation-child records served by `cabana.RelationService`; Show/save hydration uses `hydrateMLRecord`. |
 | `cabana.TranslationWriter.TranslatedExact` | Returns the stored value for a field in a locale without D-11 fallback; `ok` is false when the non-default key is missing. The default locale still reads the host column. |
diff --git a/modules/cabana/admin_openapi.go b/modules/cabana/admin_openapi.go
index 0a6be21b..a7d00069 100644
--- a/modules/cabana/admin_openapi.go
+++ b/modules/cabana/admin_openapi.go
@@ -842,7 +842,7 @@ func AdminPartial() {}
 // AdminShow documents the record show route.
 //
 // @Summary Show an admin record
-// @Description meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered.
+// @Description meta.labels carries the display labels of relation fields. meta.actions lists the declared record actions the requesting admin may run and that apply to the record's current state; it is absent when none is offered. meta.permissionLocks maps a `type: permissioneditor` field to the permissions this record fixes (the controller's cabana.PermissionRecordLockProvider), each with code, value (1, -1, or 0 for inherit) and note (localized): the admin shows that value and the note on the row and never sends the code; it is absent when no record lock applies.
 // @Tags admin
 // @Produce json
 // @Security BackendBearer
@@ -860,7 +860,7 @@ func AdminShow() {}
 // AdminUpdate documents the record update route.
 //
 // @Summary Update an admin record
-// @Description A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise.
+// @Description A plugin field type's value is decoded by its type inside the save; a value equal to the one the form was served for that field and locale is neither decoded nor written. When a type reports what it changed, meta.notices lists the localized messages per field (and content locale), and the key is absent otherwise. A record-locked permission (meta.permissionLocks) keeps its stored value when its code is absent from the body; a present value that differs from the stored one is a 403 on the field. The response carries meta.permissionLocks like the show route.
 // @Tags admin
 // @Accept json
 // @Produce json
diff --git a/modules/cabana/backend_roles_admin.go b/modules/cabana/backend_roles_admin.go
index f93292fe..97acc741 100644
--- a/modules/cabana/backend_roles_admin.go
+++ b/modules/cabana/backend_roles_admin.go
@@ -18,6 +18,9 @@ const rolesLang = "backend::lang.user.role."
 // rolesPermissionsField is the Roles form's permission editor field.
 const rolesPermissionsField = "permissions"
 
+// permissionLockedByCodeKey is the note of a role's code-declared grant.
+const permissionLockedByCodeKey = "backend::lang.permissioneditor.locked_by_code"
+
 // rolesAdmin is the Roles screen (summercms.cabana.roles), the WinterCMS
 // Backend\Controllers\UserRoles controller over backend_user_roles. Every
 // route needs backend.manage_roles.
@@ -26,14 +29,15 @@ type rolesAdmin struct {
 }
 
 var (
-	_ pact.AdminController     = rolesAdmin{}
-	_ pact.AdminPermissioned   = rolesAdmin{}
-	_ pact.AdminRecordSource   = rolesAdmin{}
-	_ pact.FormRecordTitle     = rolesAdmin{}
-	_ pact.FormBeforeCreate    = rolesAdmin{}
-	_ pact.FormBeforeUpdate    = rolesAdmin{}
-	_ pact.FormBeforeDelete    = rolesAdmin{}
-	_ PermissionEditorProvider = rolesAdmin{}
+	_ pact.AdminController         = rolesAdmin{}
+	_ pact.AdminPermissioned       = rolesAdmin{}
+	_ pact.AdminRecordSource       = rolesAdmin{}
+	_ pact.FormRecordTitle         = rolesAdmin{}
+	_ pact.FormBeforeCreate        = rolesAdmin{}
+	_ pact.FormBeforeUpdate        = rolesAdmin{}
+	_ pact.FormBeforeDelete        = rolesAdmin{}
+	_ PermissionEditorProvider     = rolesAdmin{}
+	_ PermissionRecordLockProvider = rolesAdmin{}
 )
 
 func (rolesAdmin) ID() string { return RolesControllerID }
@@ -110,6 +114,32 @@ func (rolesAdmin) AdminPermissionValues(_ context.Context, field string, record
 	return decodePermissionValues(role.Permissions, false), nil
 }
 
+// AdminPermissionRecordLocks locks, on a role that code-declared grants
+// (pact.Permission.Roles) attach to, every such grant, shown granted with
+// the locked_by_code note (D-16): the grant comes from the plugin, so
+// unticking it here would change nothing. Codes follow the catalog order.
+func (c rolesAdmin) AdminPermissionRecordLocks(_ context.Context, field string, record any) ([]PermissionRecordLock, error) {
+	role, ok := record.(*BackendUserRole)
+	if field != rolesPermissionsField || !ok || role == nil {
+		return nil, fmt.Errorf("cabana: roles: cannot read permission field %q", field)
+	}
+	reg := c.registry()
+	if reg == nil {
+		return nil, nil
+	}
+	grants := reg.rolePermissions(role.Code)
+	if len(grants) == 0 {
+		return nil, nil
+	}
+	var out []PermissionRecordLock
+	for _, code := range reg.permissionOrder {
+		if grants[code] {
+			out = append(out, PermissionRecordLock{Code: code, Value: 1, Note: permissionLockedByCodeKey})
+		}
+	}
+	return out, nil
+}
+
 // AdminSetPermissionValues stores the grants on the role; the save writes
 // the row.
 func (rolesAdmin) AdminSetPermissionValues(_ context.Context, field string, record any, values map[string]int) error {
diff --git a/modules/cabana/backend_users_admin.go b/modules/cabana/backend_users_admin.go
index a0e5febe..bbfa5eda 100644
--- a/modules/cabana/backend_users_admin.go
+++ b/modules/cabana/backend_users_admin.go
@@ -25,29 +25,30 @@ type usersAdmin struct {
 }
 
 var (
-	_ pact.AdminController       = usersAdmin{}
-	_ pact.AdminPermissioned     = usersAdmin{}
-	_ pact.AdminRecordSource     = usersAdmin{}
-	_ pact.FormRecordTitle       = usersAdmin{}
-	_ FieldRelationProvider      = usersAdmin{}
-	_ pact.ListExtendQuery       = usersAdmin{}
-	_ pact.FormExtendQuery       = usersAdmin{}
-	_ pact.FormVirtualFields     = usersAdmin{}
-	_ pact.FormRules             = usersAdmin{}
-	_ pact.FilterOptions         = usersAdmin{}
-	_ pact.FormBeforeCreate      = usersAdmin{}
-	_ pact.FormBeforeUpdate      = usersAdmin{}
-	_ pact.FormAfterUpdate       = usersAdmin{}
-	_ RelationLockProvider       = usersAdmin{}
-	_ PermissionEditorProvider   = usersAdmin{}
-	_ recordDataExtender         = usersAdmin{}
-	_ schemaFieldHider           = usersAdmin{}
-	_ pact.ListRowStates         = usersAdmin{}
-	_ pact.FormBeforeDelete      = usersAdmin{}
-	_ pact.FormAfterDelete       = usersAdmin{}
-	_ pact.HasAdminRecordActions = usersAdmin{}
-	_ pact.HasAdminBulkActions   = usersAdmin{}
-	_ pact.AdminPartialData      = usersAdmin{}
+	_ pact.AdminController         = usersAdmin{}
+	_ pact.AdminPermissioned       = usersAdmin{}
+	_ pact.AdminRecordSource       = usersAdmin{}
+	_ pact.FormRecordTitle         = usersAdmin{}
+	_ FieldRelationProvider        = usersAdmin{}
+	_ pact.ListExtendQuery         = usersAdmin{}
+	_ pact.FormExtendQuery         = usersAdmin{}
+	_ pact.FormVirtualFields       = usersAdmin{}
+	_ pact.FormRules               = usersAdmin{}
+	_ pact.FilterOptions           = usersAdmin{}
+	_ pact.FormBeforeCreate        = usersAdmin{}
+	_ pact.FormBeforeUpdate        = usersAdmin{}
+	_ pact.FormAfterUpdate         = usersAdmin{}
+	_ RelationLockProvider         = usersAdmin{}
+	_ PermissionEditorProvider     = usersAdmin{}
+	_ PermissionRecordLockProvider = usersAdmin{}
+	_ recordDataExtender           = usersAdmin{}
+	_ schemaFieldHider             = usersAdmin{}
+	_ pact.ListRowStates           = usersAdmin{}
+	_ pact.FormBeforeDelete        = usersAdmin{}
+	_ pact.FormAfterDelete         = usersAdmin{}
+	_ pact.HasAdminRecordActions   = usersAdmin{}
+	_ pact.HasAdminBulkActions     = usersAdmin{}
+	_ pact.AdminPartialData        = usersAdmin{}
 )
 
 func (usersAdmin) ID() string { return AdministratorsControllerID }
@@ -584,6 +585,32 @@ func (usersAdmin) AdminPermissionValues(_ context.Context, field string, record
 	return decodePermissionValues(user.Permissions, true), nil
 }
 
+// AdminPermissionRecordLocks locks every offered permission on the
+// editor's own record, shown with its stored override (1, -1, or 0 for
+// inherit) and the locked_self note (D-08); other records have none.
+// AdminSetPermissionValues still refuses a change on the own record.
+func (c usersAdmin) AdminPermissionRecordLocks(ctx context.Context, field string, record any) ([]PermissionRecordLock, error) {
+	user, ok := record.(*BackendUser)
+	if field != usersPermissionsField || !ok || user == nil {
+		return nil, fmt.Errorf("cabana: administrators: cannot read permission field %q", field)
+	}
+	principal, _ := bouncer.User(ctx)
+	if principal == nil || user.ID == 0 || principal.ID != user.ID {
+		return nil, nil
+	}
+	stored := decodePermissionValues(user.Permissions, true)
+	options := catalogOptions(ctx, c.registry())
+	out := make([]PermissionRecordLock, 0, len(options))
+	for _, option := range options {
+		out = append(out, PermissionRecordLock{Code: option.Code, Value: stored[option.Code], Note: permissionLockedSelfKey})
+	}
+	return out, nil
+}
+
+// permissionLockedSelfKey is the note of every permission on the editor's
+// own Administrators record.
+const permissionLockedSelfKey = "backend::lang.permissioneditor.locked_self"
+
 // AdminSetPermissionValues stores the override set on the record; the save
 // writes the row. On the editor's own record any change is refused (D-08).
 func (usersAdmin) AdminSetPermissionValues(ctx context.Context, field string, record any, values map[string]int) error {
diff --git a/modules/cabana/crud.go b/modules/cabana/crud.go
index 1d0fb32d..290c1d2c 100644
--- a/modules/cabana/crud.go
+++ b/modules/cabana/crud.go
@@ -541,6 +541,7 @@ func (s CRUDService) ShowRecord(ctx context.Context, cc *CompiledController, id
 		// RelationLockProvider may refuse the read with phrase keys.
 		return RecordResult{}, localizeControllerError(ctx, s.tr, err)
 	}
+	localizePermissionLocks(ctx, s.tr, result.Meta.PermissionLocks)
 	return result, nil
 }
 
@@ -667,6 +668,25 @@ func projectFullRecord(ctx context.Context, tx *gorm.DB, cc *CompiledController,
 	if err := projectPermissionFields(withTx(ctx, tx), cc, model, data); err != nil {
 		return RecordResult{}, err
 	}
+	// D-21: the permissions the record fixes, per permissioneditor field.
+	// Notes are phrase keys here; the show and save paths translate them.
+	for _, name := range permissionFieldNames(cc) {
+		provider, ok := cc.Controller.(PermissionRecordLockProvider)
+		if !ok || provider == nil {
+			break
+		}
+		locks, err := provider.AdminPermissionRecordLocks(withTx(ctx, tx), name, model)
+		if err != nil {
+			return RecordResult{}, lifecycleFailure(cc, err)
+		}
+		if len(locks) == 0 {
+			continue
+		}
+		if meta.PermissionLocks == nil {
+			meta.PermissionLocks = map[string][]PermissionRecordLock{}
+		}
+		meta.PermissionLocks[name] = append([]PermissionRecordLock(nil), locks...)
+	}
 	if cc != nil {
 		if ext, ok := cc.Controller.(recordDataExtender); ok && ext != nil {
 			ext.extendRecordData(ctx, model, data)
@@ -887,6 +907,7 @@ func (s CRUDService) save(ctx context.Context, cc *CompiledController, id any, i
 		return RecordResult{}, err
 	}
 	result.Meta.Notices = localizeNotices(ctx, s.tr, notices)
+	localizePermissionLocks(ctx, s.tr, result.Meta.PermissionLocks)
 	return result, nil
 }
 
diff --git a/modules/cabana/example_permission_record_locks_test.go b/modules/cabana/example_permission_record_locks_test.go
new file mode 100644
index 00000000..35e72885
--- /dev/null
+++ b/modules/cabana/example_permission_record_locks_test.go
@@ -0,0 +1,57 @@
+package cabana_test
+
+import (
+	"context"
+	"fmt"
+
+	"git.golem15.com/golem15/summercms/modules/cabana"
+)
+
+// AccessRole is a role record whose permissions the acme.access roles form
+// edits with a checkbox permission editor.
+type AccessRole struct {
+	ID   uint   `gorm:"column:id;primaryKey"`
+	Code string `gorm:"column:code"`
+}
+
+// AccessRolesController owns the roles form. CodeGrants are the grants the
+// application's plugins declare in code, per role code: they apply whatever
+// the role's stored permissions say.
+type AccessRolesController struct {
+	CodeGrants map[string][]string
+}
+
+var _ cabana.PermissionRecordLockProvider = AccessRolesController{}
+
+// AdminPermissionRecordLocks shows the grants plugins declare for the role
+// as granted and locked, with a note: unticking them on the form would
+// change nothing.
+func (c AccessRolesController) AdminPermissionRecordLocks(_ context.Context, field string, record any) ([]cabana.PermissionRecordLock, error) {
+	role := record.(*AccessRole)
+	var locks []cabana.PermissionRecordLock
+	for _, code := range c.CodeGrants[role.Code] {
+		locks = append(locks, cabana.PermissionRecordLock{
+			Code:  code,
+			Value: 1,
+			Note:  "acme.access::lang.roles.granted_by_plugin",
+		})
+	}
+	return locks, nil
+}
+
+// Example_permissionRecordLocks shows the locks of a role a plugin grants
+// two permissions to, and of a role without code grants.
+func Example_permissionRecordLocks() {
+	ctl := AccessRolesController{CodeGrants: map[string][]string{"editor": {"posts.edit", "posts.publish"}}}
+	ctx := context.Background()
+	locks, _ := ctl.AdminPermissionRecordLocks(ctx, "permissions", &AccessRole{ID: 1, Code: "editor"})
+	for _, lock := range locks {
+		fmt.Println(lock.Code, lock.Value)
+	}
+	locks, _ = ctl.AdminPermissionRecordLocks(ctx, "permissions", &AccessRole{ID: 2, Code: "guest"})
+	fmt.Println(len(locks))
+	// Output:
+	// posts.edit 1
+	// posts.publish 1
+	// 0
+}
diff --git a/modules/cabana/field_permission.go b/modules/cabana/field_permission.go
index 9768e16d..fd5cb480 100644
--- a/modules/cabana/field_permission.go
+++ b/modules/cabana/field_permission.go
@@ -64,6 +64,36 @@ type PermissionEditorProvider interface {
 	AdminSetPermissionValues(ctx context.Context, field string, record any, values map[string]int) error
 }
 
+// PermissionRecordLock is one permission whose value a stored record fixes:
+// the permission editor shows Value and Note on that row and cannot change
+// it. Code is an offered permission code; Value is what the editor shows (1
+// allow, -1 deny, 0 inherit or not granted); Note is a phrase key or text,
+// translated in the request locale before it reaches the admin.
+type PermissionRecordLock struct {
+	Code  string `json:"code"`
+	Value int    `json:"value"`
+	Note  string `json:"note"`
+}
+
+// PermissionRecordLockProvider is implemented, optionally, by an admin
+// controller that also implements PermissionEditorProvider, when some
+// permission values of a stored record cannot be changed on the form, for
+// example grants a plugin declares in code for a role, or an
+// administrator's own overrides.
+//
+// AdminPermissionRecordLocks returns the locked permissions of record for
+// field, for the administrator on ctx (read with bouncer.User). It is asked
+// for a stored record only, never on a create: to show the record (the
+// record response's meta.permissionLocks) and inside an update save, before
+// the change is applied. A record-locked code is never required in a save
+// body: when absent its stored value is kept, when present it must equal the
+// stored value, otherwise the save is answered 403 on the field. The stored
+// value is what AdminPermissionValues returns, which may differ from Value
+// (a code grant need not be stored on the role).
+type PermissionRecordLockProvider interface {
+	AdminPermissionRecordLocks(ctx context.Context, field string, record any) ([]PermissionRecordLock, error)
+}
+
 // compilePermissionKeys checks the keys of a `type: permissioneditor` field:
 // mode is required and must be radio (allow, inherit, deny) or checkbox
 // (allow), and the keys that describe choices or a column value are refused.
@@ -252,8 +282,12 @@ func permissionAllowed(mode string, value int) bool {
 // submitted code must be offered and every value in the mode's set (a 0 means
 // "no value" and is dropped): otherwise 422 on the field. A locked option's
 // stored and submitted value must be equal: otherwise a ForbiddenError (403)
-// naming the field. The next set is the stored codes that are not offered,
-// unchanged, plus the submitted codes.
+// naming the field. On an update, a code the controller's
+// PermissionRecordLockProvider locks for the record keeps its stored value:
+// a submitted value must equal it (403 on the field otherwise), an absent
+// one is not a change, and the code is left out of the locked-option
+// comparison. The next set is the stored codes that are not offered or are
+// record-locked, unchanged, plus the other submitted codes.
 func applyPermissionValues(ctx context.Context, cc *CompiledController, record any, lifted []permissionValue, update bool) error {
 	if len(lifted) == 0 {
 		return nil
@@ -285,6 +319,7 @@ func applyPermissionValues(ctx context.Context, cc *CompiledController, record a
 			submitted[code] = n
 		}
 		stored := map[string]int{}
+		recordLocked := map[string]bool{}
 		if update {
 			current, err := provider.AdminPermissionValues(ctx, value.field, record)
 			if err != nil {
@@ -293,20 +328,37 @@ func applyPermissionValues(ctx context.Context, cc *CompiledController, record a
 			for code, n := range current {
 				stored[code] = n
 			}
+			locks, err := permissionRecordLocks(ctx, cc, value.field, record)
+			if err != nil {
+				return err
+			}
+			for _, lock := range locks {
+				recordLocked[lock.Code] = true
+			}
 		}
 		next := make(map[string]int, len(stored)+len(submitted))
 		for code, n := range stored {
-			if _, known := offered[code]; !known {
+			if _, known := offered[code]; !known || recordLocked[code] {
 				next[code] = n
 			}
 		}
+		for code := range recordLocked {
+			if n, present := value.values[code]; present && n != stored[code] {
+				return &ForbiddenError{Details: map[string]any{value.field: []string{permissionLockedKey}}}
+			}
+		}
 		for _, option := range options {
+			if recordLocked[option.Code] {
+				continue
+			}
 			if option.Locked && stored[option.Code] != submitted[option.Code] {
 				return &ForbiddenError{Details: map[string]any{value.field: []string{permissionLockedKey}}}
 			}
 		}
 		for code, n := range submitted {
-			next[code] = n
+			if !recordLocked[code] {
+				next[code] = n
+			}
 		}
 		if err := provider.AdminSetPermissionValues(ctx, value.field, record, next); err != nil {
 			return lifecycleFailure(cc, err)
@@ -338,3 +390,38 @@ func projectPermissionFields(ctx context.Context, cc *CompiledController, record
 	}
 	return nil
 }
+
+// permissionRecordLocks asks the controller's PermissionRecordLockProvider
+// for the record locks of field on a stored record; nil when the controller
+// has none.
+func permissionRecordLocks(ctx context.Context, cc *CompiledController, field string, record any) ([]PermissionRecordLock, error) {
+	if cc == nil {
+		return nil, nil
+	}
+	provider, ok := cc.Controller.(PermissionRecordLockProvider)
+	if !ok || provider == nil {
+		return nil, nil
+	}
+	locks, err := provider.AdminPermissionRecordLocks(ctx, field, record)
+	if err != nil {
+		return nil, lifecycleFailure(cc, err)
+	}
+	return locks, nil
+}
+
+// localizePermissionLocks translates the notes of meta.permissionLocks in
+// the request locale. The map is the response's own.
+func localizePermissionLocks(ctx context.Context, tr *phrasebook.Translator, locks map[string][]PermissionRecordLock) {
+	if len(locks) == 0 {
+		return
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	ctx = towel.WithLocale(ctx, schemaLocale(ctx, tr))
+	for _, entries := range locks {
+		for i := range entries {
+			entries[i].Note = translateKey(ctx, tr, entries[i].Note)
+		}
+	}
+}
diff --git a/modules/cabana/record_locks_smoke_test.go b/modules/cabana/record_locks_smoke_test.go
new file mode 100644
index 00000000..fa45def2
--- /dev/null
+++ b/modules/cabana/record_locks_smoke_test.go
@@ -0,0 +1,155 @@
+package cabana
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// lockRecord is the in-test record: its stored permissions.
+type lockRecord struct {
+	ID          uint
+	Permissions map[string]int
+}
+
+// lockEditor offers a.x and a.y; withLocks also record-locks a.x at 1.
+type lockEditor struct {
+	withLocks bool
+	locked    bool // a.x also request-Locked
+	stored    map[string]int
+}
+
+func (lockEditor) ID() string        { return "acme.locks.items" }
+func (lockEditor) ModelName() string { return `Acme\Locks\Models\Item` }
+func (lockEditor) ConfigDir() string { return "controllers/items" }
+
+func (c *lockEditor) AdminPermissionOptions(context.Context, string) ([]PermissionOption, error) {
+	return []PermissionOption{{Code: "a.x", Label: "X", Locked: c.locked}, {Code: "a.y", Label: "Y"}}, nil
+}
+
+func (c *lockEditor) AdminPermissionValues(_ context.Context, _ string, record any) (map[string]int, error) {
+	r := record.(*lockRecord)
+	out := map[string]int{}
+	for code, n := range r.Permissions {
+		out[code] = n
+	}
+	return out, nil
+}
+
+func (c *lockEditor) AdminSetPermissionValues(_ context.Context, _ string, record any, values map[string]int) error {
+	c.stored = values
+	record.(*lockRecord).Permissions = values
+	return nil
+}
+
+// lockingEditor adds the record-lock provider.
+type lockingEditor struct{ *lockEditor }
+
+func (lockingEditor) AdminPermissionRecordLocks(context.Context, string, any) ([]PermissionRecordLock, error) {
+	return []PermissionRecordLock{{Code: "a.x", Value: 1, Note: "backend::lang.permissioneditor.locked_by_code"}}, nil
+}
+
+func lockController(c *lockEditor, locks bool) *CompiledController {
+	cc := &CompiledController{
+		Form:        &FormSchema{Fields: []FormField{{Name: "permissions", Type: permissionFieldType, Mode: "checkbox"}}},
+		permissions: map[string]string{"permissions": "checkbox"},
+	}
+	if locks {
+		cc.Controller = lockingEditor{c}
+	} else {
+		cc.Controller = c
+	}
+	return cc
+}
+
+func TestPermissionRecordLocksSmoke(t *testing.T) {
+	ctx := context.Background()
+	lift := func(values map[string]int) []permissionValue {
+		return []permissionValue{{field: "permissions", mode: "checkbox", values: values}}
+	}
+
+	t.Run("absent record-locked code keeps the stored value", func(t *testing.T) {
+		editor := &lockEditor{}
+		record := &lockRecord{ID: 1, Permissions: map[string]int{"a.y": 1}}
+		if err := applyPermissionValues(ctx, lockController(editor, true), record, lift(map[string]int{"a.y": 1}), true); err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := editor.stored["a.x"]; ok || editor.stored["a.y"] != 1 || len(editor.stored) != 1 {
+			t.Fatalf("stored = %v, want only a.y: 1 (a.x unchanged, absent)", editor.stored)
+		}
+	})
+
+	t.Run("record-locked code that differs from the stored value is refused", func(t *testing.T) {
+		editor := &lockEditor{}
+		record := &lockRecord{ID: 1, Permissions: map[string]int{"a.y": 1}}
+		err := applyPermissionValues(ctx, lockController(editor, true), record, lift(map[string]int{"a.x": 1, "a.y": 1}), true)
+		var forbidden *ForbiddenError
+		if !errors.As(err, &forbidden) || forbidden.Details["permissions"] == nil {
+			t.Fatalf("err = %v, want ForbiddenError on permissions", err)
+		}
+		if editor.stored != nil {
+			t.Fatalf("stored = %v after a refusal", editor.stored)
+		}
+	})
+
+	t.Run("a body equal to the stored values passes", func(t *testing.T) {
+		editor := &lockEditor{}
+		record := &lockRecord{ID: 1, Permissions: map[string]int{"a.x": 1, "a.y": 1}}
+		if err := applyPermissionValues(ctx, lockController(editor, true), record, lift(map[string]int{"a.x": 1, "a.y": 1}), true); err != nil {
+			t.Fatal(err)
+		}
+		if editor.stored["a.x"] != 1 || editor.stored["a.y"] != 1 {
+			t.Fatalf("stored = %v", editor.stored)
+		}
+	})
+
+	t.Run("request-locked and record-locked code absent from the body is not a 403", func(t *testing.T) {
+		editor := &lockEditor{locked: true}
+		record := &lockRecord{ID: 1, Permissions: map[string]int{}}
+		if err := applyPermissionValues(ctx, lockController(editor, true), record, lift(map[string]int{"a.y": 1}), true); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		// Without the record lock the same body changes nothing on a.x
+		// either: a.x is stored absent and submitted absent.
+		if err := applyPermissionValues(ctx, lockController(&lockEditor{locked: true}, false), &lockRecord{ID: 1, Permissions: map[string]int{"a.x": 1}}, lift(map[string]int{"a.y": 1}), true); err == nil {
+			t.Fatal("request-locked a.x removed without a record lock: want 403")
+		}
+	})
+
+	t.Run("record-locked codes are not asked on create", func(t *testing.T) {
+		editor := &lockEditor{}
+		if err := applyPermissionValues(ctx, lockController(editor, true), &lockRecord{}, lift(map[string]int{"a.x": 1}), false); err != nil {
+			t.Fatal(err)
+		}
+		if editor.stored["a.x"] != 1 {
+			t.Fatalf("stored = %v, want a.x on create", editor.stored)
+		}
+	})
+
+	t.Run("record meta carries permissionLocks only with a provider", func(t *testing.T) {
+		record := &lockRecord{ID: 7, Permissions: map[string]int{"a.y": 1}}
+		result, err := projectFullRecord(ctx, nil, lockController(&lockEditor{}, true), record)
+		if err != nil {
+			t.Fatal(err)
+		}
+		locks := result.Meta.PermissionLocks["permissions"]
+		if len(locks) != 1 || locks[0].Code != "a.x" || locks[0].Value != 1 || locks[0].Note == "" {
+			t.Fatalf("permissionLocks = %+v", result.Meta.PermissionLocks)
+		}
+		raw, _ := json.Marshal(result.Meta)
+		if !strings.Contains(string(raw), `"permissionLocks":{"permissions":[{"code":"a.x","value":1,"note":`) {
+			t.Fatalf("meta JSON = %s", raw)
+		}
+
+		plain, err := projectFullRecord(ctx, nil, lockController(&lockEditor{}, false), record)
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ = json.Marshal(plain.Meta)
+		if strings.Contains(string(raw), "permissionLocks") {
+			t.Fatalf("meta JSON without a provider = %s", raw)
+		}
+	})
+}
diff --git a/modules/cabana/relation_child.go b/modules/cabana/relation_child.go
index 85765ce1..5e393e81 100644
--- a/modules/cabana/relation_child.go
+++ b/modules/cabana/relation_child.go
@@ -222,6 +222,7 @@ func (s RelationService) CreateChild(ctx context.Context, cc *CompiledController
 	if err != nil {
 		return RecordResult{}, err
 	}
+	localizePermissionLocks(ctx, s.tr, result.Meta.PermissionLocks)
 	return result, nil
 }
 
@@ -307,6 +308,7 @@ func (s RelationService) ShowChild(ctx context.Context, cc *CompiledController,
 	if err != nil {
 		return RecordResult{}, err
 	}
+	localizePermissionLocks(ctx, s.tr, result.Meta.PermissionLocks)
 	return result, nil
 }
 
@@ -371,6 +373,7 @@ func (s RelationService) UpdateChild(ctx context.Context, cc *CompiledController
 	if err != nil {
 		return RecordResult{}, err
 	}
+	localizePermissionLocks(ctx, s.tr, result.Meta.PermissionLocks)
 	return result, nil
 }
 
diff --git a/modules/cabana/relation_field.go b/modules/cabana/relation_field.go
index f537ca29..feb71be1 100644
--- a/modules/cabana/relation_field.go
+++ b/modules/cabana/relation_field.go
@@ -108,6 +108,12 @@ type RecordMeta struct {
 	Labels  map[string][]RelationOption `json:"labels"`
 	Actions []RecordAction              `json:"actions,omitempty"`
 	Notices []FieldNotice               `json:"notices,omitempty"`
+	// PermissionLocks are, per permissioneditor field, the permissions this
+	// record fixes (the controller's PermissionRecordLockProvider), with the
+	// value to show and the note, translated in the request locale. The show
+	// and save responses carry it; it is omitted when no record lock applies
+	// and is never part of the form schema.
+	PermissionLocks map[string][]PermissionRecordLock `json:"permissionLocks,omitempty"`
 }
 
 // FieldNotice is one save notice: the field it is about, the content locale
diff --git a/modules/phrasebook/backend/lang/en/lang.yaml b/modules/phrasebook/backend/lang/en/lang.yaml
index b9baf688..391a98eb 100644
--- a/modules/phrasebook/backend/lang/en/lang.yaml
+++ b/modules/phrasebook/backend/lang/en/lang.yaml
@@ -261,6 +261,8 @@ permissioneditor:
   inherit: Inherit
   deny: Deny
   locked: You cannot change this permission.
+  locked_by_code: Granted to this role by a plugin. It cannot be removed here.
+  locked_self: You cannot change your own permissions.
   empty: No permissions are defined yet.
   other: Other
 api_tokens:
diff --git a/modules/phrasebook/backend/lang/pl/lang.yaml b/modules/phrasebook/backend/lang/pl/lang.yaml
index 95cc2f99..eec1b090 100644
--- a/modules/phrasebook/backend/lang/pl/lang.yaml
+++ b/modules/phrasebook/backend/lang/pl/lang.yaml
@@ -283,6 +283,8 @@ permissioneditor:
   inherit: Dziedzicz
   deny: Odmów
   locked: Nie możesz zmienić tego uprawnienia.
+  locked_by_code: Nadane tej roli przez wtyczkę. Nie można go tu odebrać.
+  locked_self: Nie możesz zmieniać własnych uprawnień.
   empty: Nie zdefiniowano jeszcze żadnych uprawnień.
   other: Inne
 api_tokens: