Sometimes it is needed to configure a role in a way that allows users to create particular entities, but denies to edit or delete them after creation.

To achieve this, do the following:

1. Open a role and switch to Type permissions tab.
2. Add a new row and select Target type.
3. Set Read and Create permissions to Allow, and Write and Delete permissions to Deny.
4. Double click on this row to open its editing form.
5. Switch to Object permissions tab and add a new row.
6. Set Write permission to Allow, and type the following in the Criteria: 
   IsNewObject([This]) = True
   This means that write is denied in general, but allowed when current object is new.
7. Save a role, assign it to some user and test how it works.