From 6405097c6b35db41fee960a8156553acef953445 Mon Sep 17 00:00:00 2001
From: Abdul Rahman <81605929+abdulrahmancodes@users.noreply.github.com>
Date: Sun, 26 Oct 2025 13:47:37 +0530
Subject: [PATCH] Add Role tab to agent detail page and fix restricted fields
 permission issue (#15276)

---
 .../ai/components/RoutingStatusDisplay.tsx    |  18 +-
 .../pages/settings/ai/SettingsAgentForm.tsx   | 103 +++++++----
 .../ai/components/SettingsAgentRoleTab.tsx    | 118 ++++++++++++
 .../components/SettingsAgentSettingsTab.tsx   | 174 ++++++++++++++++++
 .../ai/constants/SettingsAgentDetailTabs.ts   |   7 +
 .../forms/components/SettingsAIAgentForm.tsx  |  26 ---
 .../core-modules/ai/services/tool.service.ts  |  30 ++-
 .../services/create-record.service.ts         |  29 ++-
 .../services/find-records.service.ts          |  52 +++++-
 .../services/update-record.service.ts         |  35 +++-
 .../services/upsert-record.service.ts         |  31 +++-
 ...nerate-create-record-input-schema.util.ts} |   5 +-
 ...enerate-update-record-input-schema.util.ts |  33 ++++
 ...ted-columns-from-restricted-fields.util.ts |  23 +++
 .../zod-schemas/find-tool.zod-schema.ts       |  10 +-
 .../record-properties.zod-schema.ts           |  12 +-
 16 files changed, 597 insertions(+), 109 deletions(-)
 create mode 100644 packages/twenty-front/src/pages/settings/ai/components/SettingsAgentRoleTab.tsx
 create mode 100644 packages/twenty-front/src/pages/settings/ai/components/SettingsAgentSettingsTab.tsx
 create mode 100644 packages/twenty-front/src/pages/settings/ai/constants/SettingsAgentDetailTabs.ts
 rename packages/twenty-server/src/engine/core-modules/record-crud/{zod-schemas/record-input.zod-schema.ts => utils/generate-create-record-input-schema.util.ts} (79%)
 create mode 100644 packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-update-record-input-schema.util.ts
 create mode 100644 packages/twenty-server/src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util.ts

diff --git a/packages/twenty-front/src/modules/ai/components/RoutingStatusDisplay.tsx b/packages/twenty-front/src/modules/ai/components/RoutingStatusDisplay.tsx
index 468e55276a..4991c73eed 100644
--- a/packages/twenty-front/src/modules/ai/components/RoutingStatusDisplay.tsx
+++ b/packages/twenty-front/src/modules/ai/components/RoutingStatusDisplay.tsx
@@ -1,14 +1,8 @@
 import { ShimmeringText } from '@/ai/components/ShimmeringText';
-import { keyframes } from '@emotion/react';
 import styled from '@emotion/styled';
 import { type DataMessagePart } from 'twenty-shared/ai';
 import { IconCpu, IconSparkles } from 'twenty-ui/display';
 
-const pulseAnimation = keyframes`
-  0%, 100% { opacity: 1; }
-  50% { opacity: 0.5; }
-`;
-
 const StyledRoutingContainer = styled.div`
   align-items: center;
   background: ${({ theme }) => theme.background.transparent.lighter};
@@ -25,9 +19,19 @@ const StyledRoutingContainer = styled.div`
 const StyledIconContainer = styled.div<{ isLoading: boolean }>`
   align-items: center;
   animation: ${({ isLoading }) =>
-    isLoading ? `${pulseAnimation} 2s ease-in-out infinite` : 'none'};
+    isLoading ? 'pulseAnimation 2s ease-in-out infinite' : 'none'};
   color: ${({ theme }) => theme.color.blue};
   display: flex;
+
+  @keyframes pulseAnimation {
+    0%,
+    100% {
+      opacity: 1;
+    }
+    50% {
+      opacity: 0.5;
+    }
+  }
 `;
 
 const StyledText = styled.div`
diff --git a/packages/twenty-front/src/pages/settings/ai/SettingsAgentForm.tsx b/packages/twenty-front/src/pages/settings/ai/SettingsAgentForm.tsx
index 8484697751..57f9de8882 100644
--- a/packages/twenty-front/src/pages/settings/ai/SettingsAgentForm.tsx
+++ b/packages/twenty-front/src/pages/settings/ai/SettingsAgentForm.tsx
@@ -5,13 +5,14 @@ import { useParams } from 'react-router-dom';
 import { SaveAndCancelButtons } from '@/settings/components/SaveAndCancelButtons/SaveAndCancelButtons';
 import { SettingsPageContainer } from '@/settings/components/SettingsPageContainer';
 import { useSnackBar } from '@/ui/feedback/snack-bar-manager/hooks/useSnackBar';
-import { useModal } from '@/ui/layout/modal/hooks/useModal';
 import { SubMenuTopBarContainer } from '@/ui/layout/page/components/SubMenuTopBarContainer';
+import { TabList } from '@/ui/layout/tab-list/components/TabList';
+import { activeTabIdComponentState } from '@/ui/layout/tab-list/states/activeTabIdComponentState';
+import { useRecoilComponentValue } from '@/ui/utilities/state/component-state/hooks/useRecoilComponentValue';
 import { t } from '@lingui/core/macro';
 import { AppPath, SettingsPath } from 'twenty-shared/types';
 import { getSettingsPath, isDefined } from 'twenty-shared/utils';
-import { H2Title, IconTrash } from 'twenty-ui/display';
-import { Button } from 'twenty-ui/input';
+import { H2Title, IconLock, IconSettings } from 'twenty-ui/display';
 import { Section } from 'twenty-ui/layout';
 import {
   type CreateAgentInput,
@@ -23,9 +24,10 @@ import { useNavigateApp } from '~/hooks/useNavigateApp';
 import { useNavigateSettings } from '~/hooks/useNavigateSettings';
 
 import { useState } from 'react';
-import { SettingsAgentDeleteConfirmationModal } from './components/SettingsAgentDeleteConfirmationModal';
 import { SettingsAgentDetailSkeletonLoader } from './components/SettingsAgentDetailSkeletonLoader';
-import { SettingsAIAgentForm } from './forms/components/SettingsAIAgentForm';
+import { SettingsAgentRoleTab } from './components/SettingsAgentRoleTab';
+import { SettingsAgentSettingsTab } from './components/SettingsAgentSettingsTab';
+import { SETTINGS_AGENT_DETAIL_TABS } from './constants/SettingsAgentDetailTabs';
 import { useSettingsAgentFormState } from './hooks/useSettingsAgentFormState';
 
 const StyledContentContainer = styled.div`
@@ -36,20 +38,26 @@ const StyledContentContainer = styled.div`
   width: 100%;
 `;
 
-const DELETE_AGENT_MODAL_ID = 'delete-agent-modal';
+const StyledTabList = styled(TabList)`
+  margin-bottom: ${({ theme }) => theme.spacing(8)};
+`;
 
 export const SettingsAgentForm = ({ mode }: { mode: 'create' | 'edit' }) => {
   const { agentId = '' } = useParams<{ agentId: string }>();
   const navigate = useNavigateSettings();
   const navigateApp = useNavigateApp();
   const { enqueueErrorSnackBar } = useSnackBar();
-  const { openModal } = useModal();
   const [isReadonlyMode, setIsReadonlyMode] = useState(false);
 
   const isEditMode = mode === 'edit';
-
   const isCreateMode = mode === 'create';
 
+  const tabListComponentId = `${SETTINGS_AGENT_DETAIL_TABS.COMPONENT_INSTANCE_ID}-${agentId}`;
+  const activeTabId = useRecoilComponentValue(
+    activeTabIdComponentState,
+    tabListComponentId,
+  );
+
   const {
     formValues,
     isSubmitting,
@@ -105,6 +113,19 @@ export const SettingsAgentForm = ({ mode }: { mode: 'create' | 'edit' }) => {
 
   const canSave = !isReadonlyMode && validateForm() && !isSubmitting;
 
+  const tabs = [
+    {
+      id: SETTINGS_AGENT_DETAIL_TABS.TABS_IDS.SETTINGS,
+      title: t`Settings`,
+      Icon: IconSettings,
+    },
+    {
+      id: SETTINGS_AGENT_DETAIL_TABS.TABS_IDS.ROLE,
+      title: t`Role`,
+      Icon: IconLock,
+    },
+  ];
+
   const handleSave = async () => {
     if (isReadonlyMode) {
       return;
@@ -181,6 +202,31 @@ export const SettingsAgentForm = ({ mode }: { mode: 'create' | 'edit' }) => {
       : agent?.label
     : t`New Agent`;
 
+  const renderActiveTabContent = () => {
+    switch (activeTabId) {
+      case SETTINGS_AGENT_DETAIL_TABS.TABS_IDS.ROLE:
+        return (
+          <SettingsAgentRoleTab
+            formValues={formValues}
+            onFieldChange={handleFieldChange}
+            disabled={isReadonlyMode || (isEditMode ? !agent?.isCustom : false)}
+          />
+        );
+
+      case SETTINGS_AGENT_DETAIL_TABS.TABS_IDS.SETTINGS:
+        return (
+          <SettingsAgentSettingsTab
+            formValues={formValues}
+            onFieldChange={handleFieldChange}
+            disabled={isReadonlyMode || (isEditMode ? !agent?.isCustom : false)}
+            agent={agent}
+          />
+        );
+      default:
+        return <></>;
+    }
+  };
+
   return (
     <>
       <SubMenuTopBarContainer
@@ -211,43 +257,20 @@ export const SettingsAgentForm = ({ mode }: { mode: 'create' | 'edit' }) => {
             {isEditMode && loading ? (
               <SettingsAgentDetailSkeletonLoader />
             ) : (
-              <StyledContentContainer>
-                <SettingsAIAgentForm
-                  formValues={formValues}
-                  onFieldChange={handleFieldChange}
-                  disabled={
-                    isReadonlyMode || (isEditMode ? !agent?.isCustom : false)
-                  }
+              <>
+                <StyledTabList
+                  tabs={tabs}
+                  className="tab-list"
+                  componentInstanceId={tabListComponentId}
                 />
-                {!isReadonlyMode &&
-                  isEditMode &&
-                  agent &&
-                  formValues.isCustom && (
-                    <Section>
-                      <H2Title
-                        title={t`Danger zone`}
-                        description={t`Delete this agent`}
-                      />
-                      <Button
-                        accent="danger"
-                        variant="secondary"
-                        title={t`Delete Agent`}
-                        Icon={IconTrash}
-                        onClick={() => openModal(DELETE_AGENT_MODAL_ID)}
-                      />
-                    </Section>
-                  )}
-              </StyledContentContainer>
+                <StyledContentContainer>
+                  {renderActiveTabContent()}
+                </StyledContentContainer>
+              </>
             )}
           </Section>
         </SettingsPageContainer>
       </SubMenuTopBarContainer>
-      {isEditMode && agent && (
-        <SettingsAgentDeleteConfirmationModal
-          agentId={agent.id}
-          agentName={agent.label}
-        />
-      )}
     </>
   );
 };
diff --git a/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentRoleTab.tsx b/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentRoleTab.tsx
new file mode 100644
index 0000000000..3f2130dca5
--- /dev/null
+++ b/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentRoleTab.tsx
@@ -0,0 +1,118 @@
+import styled from '@emotion/styled';
+import { useLingui } from '@lingui/react/macro';
+
+import { SettingsRolePermissions } from '@/settings/roles/role-permissions/components/SettingsRolePermissions';
+import { Select } from '@/ui/input/components/Select';
+import { SettingsPath } from 'twenty-shared/types';
+import { isDefined } from 'twenty-shared/utils';
+import {
+  H1Title,
+  H1TitleFontColor,
+  H2Title,
+  IconArrowUpRight,
+  IconUser,
+  useIcons,
+} from 'twenty-ui/display';
+import { Button } from 'twenty-ui/input';
+import { Section } from 'twenty-ui/layout';
+import { useGetRolesQuery } from '~/generated-metadata/graphql';
+import { useNavigateSettings } from '~/hooks/useNavigateSettings';
+import { type SettingsAIAgentFormValues } from '../hooks/useSettingsAgentFormState';
+
+const StyledRoleContainer = styled.div`
+  align-items: flex-end;
+  display: flex;
+  gap: ${({ theme }) => theme.spacing(2)};
+  margin-bottom: ${({ theme }) => theme.spacing(8)};
+`;
+
+const StyledRoleSelector = styled.div`
+  flex: 1;
+`;
+
+type SettingsAgentRoleTabProps = {
+  formValues: SettingsAIAgentFormValues;
+  onFieldChange: (
+    field: keyof SettingsAIAgentFormValues,
+    value: SettingsAIAgentFormValues[keyof SettingsAIAgentFormValues],
+  ) => void;
+  disabled: boolean;
+};
+
+export const SettingsAgentRoleTab = ({
+  formValues,
+  onFieldChange,
+  disabled,
+}: SettingsAgentRoleTabProps) => {
+  const { t } = useLingui();
+  const { getIcon } = useIcons();
+  const navigateSettings = useNavigateSettings();
+
+  const { data: rolesData } = useGetRolesQuery();
+
+  const rolesOptions = [
+    {
+      label: t`None`,
+      value: null,
+      Icon: IconUser,
+    },
+    ...(rolesData?.getRoles
+      ?.filter((role) => role.canBeAssignedToAgents)
+      .map((role) => ({
+        label: role.label,
+        value: role.id,
+        Icon: getIcon(role.icon) ?? IconUser,
+      })) || []),
+  ];
+
+  const selectedRole = rolesData?.getRoles?.find(
+    (role) => role.id === formValues.role,
+  );
+
+  const handleOpenRole = () => {
+    if (isDefined(selectedRole)) {
+      navigateSettings(SettingsPath.RoleDetail, { roleId: selectedRole.id });
+    }
+  };
+
+  return (
+    <Section>
+      <H2Title
+        title={t`Role`}
+        description={t`The agent can perform all actions defined by the following role.`}
+      />
+      <StyledRoleContainer>
+        <StyledRoleSelector>
+          <Select
+            dropdownId="agent-role-select"
+            options={rolesOptions}
+            value={formValues.role || ''}
+            onChange={(value) => onFieldChange('role', value)}
+            disabled={disabled}
+            withSearchInput
+            fullWidth
+          />
+        </StyledRoleSelector>
+        <Button
+          Icon={IconArrowUpRight}
+          title={t`Open`}
+          variant="secondary"
+          onClick={handleOpenRole}
+          disabled={!selectedRole}
+        />
+      </StyledRoleContainer>
+      {selectedRole?.id && (
+        <>
+          <H1Title
+            title={t`Role Permissions`}
+            fontColor={H1TitleFontColor.Primary}
+          />
+          <SettingsRolePermissions
+            roleId={selectedRole.id}
+            isEditable={false}
+          />
+        </>
+      )}
+    </Section>
+  );
+};
diff --git a/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentSettingsTab.tsx b/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentSettingsTab.tsx
new file mode 100644
index 0000000000..0f4169cd0c
--- /dev/null
+++ b/packages/twenty-front/src/pages/settings/ai/components/SettingsAgentSettingsTab.tsx
@@ -0,0 +1,174 @@
+import styled from '@emotion/styled';
+import { useLingui } from '@lingui/react/macro';
+
+import { useAiModelOptions } from '@/ai/hooks/useAiModelOptions';
+import { IconPicker } from '@/ui/input/components/IconPicker';
+import { Select } from '@/ui/input/components/Select';
+import { SettingsTextInput } from '@/ui/input/components/SettingsTextInput';
+import { TextArea } from '@/ui/input/components/TextArea';
+import { useModal } from '@/ui/layout/modal/hooks/useModal';
+import { isDefined } from 'twenty-shared/utils';
+import { H2Title, IconTrash } from 'twenty-ui/display';
+import { Button } from 'twenty-ui/input';
+import { Section } from 'twenty-ui/layout';
+import { type Agent } from '~/generated/graphql';
+import { SettingsAgentDeleteConfirmationModal } from '~/pages/settings/ai/components/SettingsAgentDeleteConfirmationModal';
+import { computeMetadataNameFromLabel } from '~/pages/settings/data-model/utils/computeMetadataNameFromLabel';
+import { SettingsAgentModelCapabilities } from '../components/SettingsAgentModelCapabilities';
+import { type SettingsAIAgentFormValues } from '../hooks/useSettingsAgentFormState';
+
+const StyledFormContainer = styled.div`
+  display: flex;
+  flex-direction: column;
+  gap: ${({ theme }) => theme.spacing(2)};
+`;
+
+const StyledIconNameRow = styled.div`
+  align-items: flex-start;
+  display: flex;
+  gap: ${({ theme }) => theme.spacing(2)};
+`;
+
+const StyledNameContainer = styled.div`
+  flex: 1;
+`;
+
+const StyledErrorMessage = styled.div`
+  color: ${({ theme }) => theme.color.red};
+  font-size: ${({ theme }) => theme.font.size.sm};
+  margin-top: ${({ theme }) => theme.spacing(1)};
+`;
+
+const DELETE_AGENT_MODAL_ID = 'delete-agent-modal';
+
+type SettingsAgentSettingsTabProps = {
+  formValues: SettingsAIAgentFormValues;
+  onFieldChange: (
+    field: keyof SettingsAIAgentFormValues,
+    value: SettingsAIAgentFormValues[keyof SettingsAIAgentFormValues],
+  ) => void;
+  disabled: boolean;
+  agent?: Agent;
+};
+
+export const SettingsAgentSettingsTab = ({
+  formValues,
+  onFieldChange,
+  disabled,
+  agent,
+}: SettingsAgentSettingsTabProps) => {
+  const { t } = useLingui();
+  const { openModal } = useModal();
+
+  const modelOptions = useAiModelOptions();
+
+  const noModelsAvailable = modelOptions.length === 0;
+
+  const fillNameFromLabel = (label: string) => {
+    if (isDefined(label)) {
+      onFieldChange('name', computeMetadataNameFromLabel(label));
+    }
+  };
+
+  return (
+    <StyledFormContainer>
+      <StyledFormContainer>
+        <StyledIconNameRow>
+          <IconPicker
+            selectedIconKey={formValues.icon || 'IconRobot'}
+            onChange={({ iconKey }) => {
+              onFieldChange('icon', iconKey);
+            }}
+            disabled={disabled}
+          />
+
+          <StyledNameContainer>
+            <SettingsTextInput
+              instanceId="agent-label-input"
+              placeholder={t`Enter agent name*`}
+              value={formValues.label}
+              onChange={(value) => {
+                onFieldChange('label', value);
+                fillNameFromLabel(value);
+              }}
+              fullWidth
+              disabled={disabled}
+            />
+          </StyledNameContainer>
+        </StyledIconNameRow>
+      </StyledFormContainer>
+
+      <StyledFormContainer>
+        <TextArea
+          textAreaId="agent-description-textarea"
+          placeholder={t`Write a description for this agent`}
+          minRows={3}
+          value={formValues.description || ''}
+          onChange={(value) => onFieldChange('description', value)}
+          disabled={disabled}
+        />
+      </StyledFormContainer>
+
+      <StyledFormContainer>
+        <Select
+          dropdownId="ai-model-select"
+          label={t`AI Model`}
+          value={formValues.modelId}
+          onChange={(value) => onFieldChange('modelId', value)}
+          options={modelOptions}
+          disabled={noModelsAvailable || disabled}
+        />
+        {noModelsAvailable && (
+          <StyledErrorMessage>
+            {t`No models available. Please configure AI models in your workspace settings.`}
+          </StyledErrorMessage>
+        )}
+      </StyledFormContainer>
+
+      {formValues.modelId && (
+        <StyledFormContainer>
+          <SettingsAgentModelCapabilities
+            selectedModelId={formValues.modelId}
+            modelConfiguration={formValues.modelConfiguration || {}}
+            onConfigurationChange={(configuration) =>
+              onFieldChange('modelConfiguration', configuration)
+            }
+            disabled={disabled}
+          />
+        </StyledFormContainer>
+      )}
+
+      <StyledFormContainer>
+        <TextArea
+          textAreaId="agent-prompt-textarea"
+          label={t`System Prompt`}
+          placeholder={t`Enter the system prompt that defines this agent's behavior and capabilities`}
+          minRows={6}
+          maxRows={15}
+          value={formValues.prompt}
+          onChange={(value) => onFieldChange('prompt', value)}
+          disabled={disabled}
+        />
+      </StyledFormContainer>
+
+      {!disabled && agent && formValues.isCustom && (
+        <Section>
+          <H2Title title={t`Danger zone`} description={t`Delete this agent`} />
+          <Button
+            accent="danger"
+            variant="secondary"
+            title={t`Delete Agent`}
+            Icon={IconTrash}
+            onClick={() => openModal(DELETE_AGENT_MODAL_ID)}
+          />
+        </Section>
+      )}
+      {!disabled && agent && (
+        <SettingsAgentDeleteConfirmationModal
+          agentId={agent.id}
+          agentName={agent.label}
+        />
+      )}
+    </StyledFormContainer>
+  );
+};
diff --git a/packages/twenty-front/src/pages/settings/ai/constants/SettingsAgentDetailTabs.ts b/packages/twenty-front/src/pages/settings/ai/constants/SettingsAgentDetailTabs.ts
new file mode 100644
index 0000000000..71fa03521f
--- /dev/null
+++ b/packages/twenty-front/src/pages/settings/ai/constants/SettingsAgentDetailTabs.ts
@@ -0,0 +1,7 @@
+export const SETTINGS_AGENT_DETAIL_TABS = {
+  COMPONENT_INSTANCE_ID: 'settings-agent-detail-tabs',
+  TABS_IDS: {
+    ROLE: 'role',
+    SETTINGS: 'settings',
+  },
+};
diff --git a/packages/twenty-front/src/pages/settings/ai/forms/components/SettingsAIAgentForm.tsx b/packages/twenty-front/src/pages/settings/ai/forms/components/SettingsAIAgentForm.tsx
index 5d05204b14..0d8847716b 100644
--- a/packages/twenty-front/src/pages/settings/ai/forms/components/SettingsAIAgentForm.tsx
+++ b/packages/twenty-front/src/pages/settings/ai/forms/components/SettingsAIAgentForm.tsx
@@ -7,7 +7,6 @@ import { Select } from '@/ui/input/components/Select';
 import { SettingsTextInput } from '@/ui/input/components/SettingsTextInput';
 import { TextArea } from '@/ui/input/components/TextArea';
 import { isDefined } from 'twenty-shared/utils';
-import { useGetRolesQuery } from '~/generated-metadata/graphql';
 import { computeMetadataNameFromLabel } from '~/pages/settings/data-model/utils/computeMetadataNameFromLabel';
 import { SettingsAgentModelCapabilities } from '../../components/SettingsAgentModelCapabilities';
 import { type SettingsAIAgentFormValues } from '../../hooks/useSettingsAgentFormState';
@@ -51,20 +50,6 @@ export const SettingsAIAgentForm = ({
   const { t } = useLingui();
 
   const modelOptions = useAiModelOptions();
-  const { data: rolesData } = useGetRolesQuery();
-
-  const rolesOptions = [
-    {
-      label: t`None`,
-      value: null,
-    },
-    ...(rolesData?.getRoles
-      ?.filter((role) => role.canBeAssignedToAgents)
-      .map((role) => ({
-        label: role.label,
-        value: role.id,
-      })) || []),
-  ];
 
   const noModelsAvailable = modelOptions.length === 0;
 
@@ -141,17 +126,6 @@ export const SettingsAIAgentForm = ({
         </StyledFormContainer>
       )}
 
-      <StyledFormContainer>
-        <Select
-          dropdownId="ai-role-select"
-          label={t`Role`}
-          value={formValues.role || ''}
-          onChange={(value) => onFieldChange('role', value)}
-          options={rolesOptions}
-          disabled={disabled}
-        />
-      </StyledFormContainer>
-
       <StyledFormContainer>
         <TextArea
           textAreaId="agent-prompt-textarea"
diff --git a/packages/twenty-server/src/engine/core-modules/ai/services/tool.service.ts b/packages/twenty-server/src/engine/core-modules/ai/services/tool.service.ts
index 1ceb6c277c..1a5a664ca3 100644
--- a/packages/twenty-server/src/engine/core-modules/ai/services/tool.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/ai/services/tool.service.ts
@@ -6,10 +6,11 @@ import { CreateRecordService } from 'src/engine/core-modules/record-crud/service
 import { DeleteRecordService } from 'src/engine/core-modules/record-crud/services/delete-record.service';
 import { FindRecordsService } from 'src/engine/core-modules/record-crud/services/find-records.service';
 import { UpdateRecordService } from 'src/engine/core-modules/record-crud/services/update-record.service';
+import { generateCreateRecordInputSchema } from 'src/engine/core-modules/record-crud/utils/generate-create-record-input-schema.util';
+import { generateUpdateRecordInputSchema } from 'src/engine/core-modules/record-crud/utils/generate-update-record-input-schema.util';
 import { BulkDeleteToolInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/bulk-delete-tool.zod-schema';
-import { generateFindToolInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema';
 import { FindOneToolInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/find-one-tool.zod-schema';
-import { generateRecordInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/record-input.zod-schema';
+import { generateFindToolInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema';
 import { SoftDeleteToolInputSchema } from 'src/engine/core-modules/record-crud/zod-schemas/soft-delete-tool.zod-schema';
 import { isWorkflowRunObject } from 'src/engine/metadata-modules/agent/utils/is-workflow-run-object.util';
 import { type ActorMetadata } from 'src/engine/metadata-modules/field-metadata/composite-types/actor.composite-type';
@@ -87,10 +88,15 @@ export class ToolService {
         return;
       }
 
+      const restrictedFields = objectPermission.restrictedFields;
+
       if (objectPermission.canUpdateObjectRecords) {
         tools[`create_${objectMetadata.nameSingular}`] = {
           description: `Create a new ${objectMetadata.labelSingular} record. Provide all required fields and any optional fields you want to set. The system will automatically handle timestamps and IDs. Returns the created record with all its data.`,
-          inputSchema: generateRecordInputSchema(objectMetadata),
+          inputSchema: generateCreateRecordInputSchema(
+            objectMetadata,
+            restrictedFields,
+          ),
           execute: async (parameters) => {
             return this.createRecordService.execute({
               objectName: objectMetadata.nameSingular,
@@ -104,9 +110,18 @@ export class ToolService {
 
         tools[`update_${objectMetadata.nameSingular}`] = {
           description: `Update an existing ${objectMetadata.labelSingular} record. Provide the record ID and only the fields you want to change. Unspecified fields will remain unchanged. Returns the updated record with all current data.`,
-          inputSchema: generateRecordInputSchema(objectMetadata),
+          inputSchema: generateUpdateRecordInputSchema(
+            objectMetadata,
+            restrictedFields,
+          ),
           execute: async (parameters) => {
-            const { id, ...objectRecord } = parameters.input;
+            const { id, ...allFields } = parameters.input;
+
+            const objectRecord = Object.fromEntries(
+              Object.entries(allFields).filter(
+                ([, value]) => value !== undefined,
+              ),
+            );
 
             return this.updateRecordService.execute({
               objectName: objectMetadata.nameSingular,
@@ -122,7 +137,10 @@ export class ToolService {
       if (objectPermission.canReadObjectRecords) {
         tools[`find_${objectMetadata.nameSingular}`] = {
           description: `Search for ${objectMetadata.labelSingular} records using flexible filtering criteria. Supports exact matches, pattern matching, ranges, and null checks. Use limit/offset for pagination and orderBy for sorting. Returns an array of matching records with their full data.`,
-          inputSchema: generateFindToolInputSchema(objectMetadata),
+          inputSchema: generateFindToolInputSchema(
+            objectMetadata,
+            restrictedFields,
+          ),
           execute: async (parameters) => {
             const { limit, offset, orderBy, ...filter } = parameters.input;
 
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/services/create-record.service.ts b/packages/twenty-server/src/engine/core-modules/record-crud/services/create-record.service.ts
index f35b67a824..12cdfd9315 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/services/create-record.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/services/create-record.service.ts
@@ -8,6 +8,7 @@ import {
   RecordCrudExceptionCode,
 } from 'src/engine/core-modules/record-crud/exceptions/record-crud.exception';
 import { type CreateRecordParams } from 'src/engine/core-modules/record-crud/types/create-record-params.type';
+import { getSelectedColumnsFromRestrictedFields } from 'src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util';
 import { RecordPositionService } from 'src/engine/core-modules/record-position/services/record-position.service';
 import { RecordInputTransformerService } from 'src/engine/core-modules/record-transformer/services/record-input-transformer.service';
 import { type ToolOutput } from 'src/engine/core-modules/tool/types/tool-output.type';
@@ -83,14 +84,28 @@ export class CreateRecordService {
           objectMetadataMapItem: objectMetadataItemWithFieldsMaps,
         });
 
-      const insertResult = await repository.insert({
-        ...transformedObjectRecord,
-        position,
-        createdBy: params.createdBy ?? {
-          source: FieldActorSource.WORKFLOW,
-          name: 'Workflow',
+      const restrictedFields =
+        repository.objectRecordsPermissions?.[
+          objectMetadataItemWithFieldsMaps.id
+        ]?.restrictedFields;
+
+      const selectedColumns = getSelectedColumnsFromRestrictedFields(
+        restrictedFields,
+        objectMetadataItemWithFieldsMaps,
+      );
+
+      const insertResult = await repository.insert(
+        {
+          ...transformedObjectRecord,
+          position,
+          createdBy: params.createdBy ?? {
+            source: FieldActorSource.WORKFLOW,
+            name: 'Workflow',
+          },
         },
-      });
+        undefined,
+        selectedColumns,
+      );
 
       const [createdRecord] = insertResult.generatedMaps;
 
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/services/find-records.service.ts b/packages/twenty-server/src/engine/core-modules/record-crud/services/find-records.service.ts
index 85f8e4debd..8cd7f61d61 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/services/find-records.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/services/find-records.service.ts
@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';
 
+import isEmpty from 'lodash.isempty';
 import { QUERY_MAX_RECORDS } from 'twenty-shared/constants';
 import { OrderByDirection } from 'twenty-shared/types';
 import { type ObjectLiteral } from 'typeorm';
@@ -10,9 +11,12 @@ import {
 } from 'src/engine/api/graphql/workspace-query-builder/interfaces/object-record.interface';
 
 import { GraphqlQueryParser } from 'src/engine/api/graphql/graphql-query-runner/graphql-query-parsers/graphql-query.parser';
+import { getAllSelectableFields } from 'src/engine/api/utils/get-all-selectable-fields.utils';
 import { type FindRecordsParams } from 'src/engine/core-modules/record-crud/types/find-records-params.type';
 import { FindRecordsResult } from 'src/engine/core-modules/record-crud/types/find-records-result.type';
 import { type ToolOutput } from 'src/engine/core-modules/tool/types/tool-output.type';
+import { type ObjectMetadataItemWithFieldMaps } from 'src/engine/metadata-modules/types/object-metadata-item-with-field-maps';
+import { type WorkspaceSelectQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-select-query-builder';
 import { type WorkspaceRepository } from 'src/engine/twenty-orm/repository/workspace.repository';
 import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
 import { WorkflowCommonWorkspaceService } from 'src/modules/workflow/common/workspace-services/workflow-common.workspace-service';
@@ -75,6 +79,7 @@ export class FindRecordsService {
         offset,
         repository,
         graphqlQueryParser,
+        objectMetadataItemWithFieldsMaps,
       });
 
       const totalCount = await this.getTotalCount({
@@ -82,6 +87,7 @@ export class FindRecordsService {
         filter,
         repository,
         graphqlQueryParser,
+        objectMetadataItemWithFieldsMaps,
       });
 
       this.logger.log(`Found ${records.length} records in ${objectName}`);
@@ -106,6 +112,32 @@ export class FindRecordsService {
     }
   }
 
+  private applyRestrictedFieldsToQueryBuilder<T extends ObjectLiteral>(
+    queryBuilder: WorkspaceSelectQueryBuilder<T>,
+    repository: WorkspaceRepository<T>,
+    objectMetadataItemWithFieldsMaps: ObjectMetadataItemWithFieldMaps,
+  ): WorkspaceSelectQueryBuilder<T> {
+    const restrictedFields =
+      repository.objectRecordsPermissions?.[objectMetadataItemWithFieldsMaps.id]
+        ?.restrictedFields;
+
+    if (!restrictedFields || isEmpty(restrictedFields)) {
+      return queryBuilder;
+    }
+
+    const selectableFields = getAllSelectableFields({
+      restrictedFields,
+      objectMetadata: {
+        objectMetadataMapItem: objectMetadataItemWithFieldsMaps,
+      },
+    });
+
+    return queryBuilder.setFindOptions({
+      // @ts-expect-error - TypeORM typing limitation with dynamic select fields
+      select: selectableFields,
+    });
+  }
+
   private async getObjectRecords<T extends ObjectLiteral>({
     objectName,
     filter,
@@ -114,6 +146,7 @@ export class FindRecordsService {
     offset,
     repository,
     graphqlQueryParser,
+    objectMetadataItemWithFieldsMaps,
   }: {
     objectName: string;
     filter:
@@ -125,6 +158,7 @@ export class FindRecordsService {
     offset: number;
     repository: WorkspaceRepository<T>;
     graphqlQueryParser: GraphqlQueryParser;
+    objectMetadataItemWithFieldsMaps: ObjectMetadataItemWithFieldMaps;
   }): Promise<T[]> {
     const queryBuilder = repository.createQueryBuilder(objectName);
 
@@ -146,7 +180,13 @@ export class FindRecordsService {
       false,
     );
 
-    return withOrderByQueryBuilder
+    const queryBuilderWithSelect = this.applyRestrictedFieldsToQueryBuilder(
+      withOrderByQueryBuilder,
+      repository,
+      objectMetadataItemWithFieldsMaps,
+    );
+
+    return queryBuilderWithSelect
       .skip(offset)
       .take(limit ? Math.min(limit, QUERY_MAX_RECORDS) : QUERY_MAX_RECORDS)
       .getMany();
@@ -157,6 +197,7 @@ export class FindRecordsService {
     filter,
     repository,
     graphqlQueryParser,
+    objectMetadataItemWithFieldsMaps,
   }: {
     objectName: string;
     filter:
@@ -165,6 +206,7 @@ export class FindRecordsService {
       | undefined;
     repository: WorkspaceRepository<ObjectLiteral>;
     graphqlQueryParser: GraphqlQueryParser;
+    objectMetadataItemWithFieldsMaps: ObjectMetadataItemWithFieldMaps;
   }): Promise<number> {
     const countQueryBuilder = repository.createQueryBuilder(objectName);
 
@@ -180,6 +222,12 @@ export class FindRecordsService {
         filter ?? {},
       );
 
-    return withDeletedCountQueryBuilder.getCount();
+    const queryBuilderWithSelect = this.applyRestrictedFieldsToQueryBuilder(
+      withDeletedCountQueryBuilder,
+      repository,
+      objectMetadataItemWithFieldsMaps,
+    );
+
+    return queryBuilderWithSelect.getCount();
   }
 }
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/services/update-record.service.ts b/packages/twenty-server/src/engine/core-modules/record-crud/services/update-record.service.ts
index 4b4f1c2ea1..8d974af88e 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/services/update-record.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/services/update-record.service.ts
@@ -9,6 +9,7 @@ import {
   RecordCrudExceptionCode,
 } from 'src/engine/core-modules/record-crud/exceptions/record-crud.exception';
 import { type UpdateRecordParams } from 'src/engine/core-modules/record-crud/types/update-record-params.type';
+import { getSelectedColumnsFromRestrictedFields } from 'src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util';
 import { RecordInputTransformerService } from 'src/engine/core-modules/record-transformer/services/record-input-transformer.service';
 import { type ToolOutput } from 'src/engine/core-modules/tool/types/tool-output.type';
 import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
@@ -59,10 +60,27 @@ export class UpdateRecordService {
           rolePermissionConfig,
         );
 
+      const { objectMetadataItemWithFieldsMaps } =
+        await this.workflowCommonWorkspaceService.getObjectMetadataItemWithFieldsMaps(
+          objectName,
+          workspaceId,
+        );
+
+      const restrictedFields =
+        repository.objectRecordsPermissions?.[
+          objectMetadataItemWithFieldsMaps.id
+        ]?.restrictedFields;
+
+      const selectedColumns = getSelectedColumnsFromRestrictedFields(
+        restrictedFields,
+        objectMetadataItemWithFieldsMaps,
+      );
+
       const previousObjectRecord = await repository.findOne({
         where: {
           id: objectRecordId,
         },
+        select: selectedColumns,
       });
 
       if (!previousObjectRecord) {
@@ -82,12 +100,6 @@ export class UpdateRecordService {
         };
       }
 
-      const { objectMetadataItemWithFieldsMaps } =
-        await this.workflowCommonWorkspaceService.getObjectMetadataItemWithFieldsMaps(
-          objectName,
-          workspaceId,
-        );
-
       if (
         !canObjectBeManagedByWorkflow({
           nameSingular: objectMetadataItemWithFieldsMaps.nameSingular,
@@ -126,9 +138,14 @@ export class UpdateRecordService {
       };
 
       if (!deepEqual(updatedObjectRecord, previousObjectRecord)) {
-        await repository.update(objectRecordId, {
-          ...transformedObjectRecord,
-        });
+        await repository.update(
+          objectRecordId,
+          {
+            ...transformedObjectRecord,
+          },
+          undefined,
+          selectedColumns,
+        );
       }
 
       this.logger.log(`Record updated successfully in ${objectName}`);
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/services/upsert-record.service.ts b/packages/twenty-server/src/engine/core-modules/record-crud/services/upsert-record.service.ts
index bdc248ba63..c56d4842b6 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/services/upsert-record.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/services/upsert-record.service.ts
@@ -8,6 +8,7 @@ import {
   RecordCrudExceptionCode,
 } from 'src/engine/core-modules/record-crud/exceptions/record-crud.exception';
 import { UpsertRecordParams } from 'src/engine/core-modules/record-crud/types/upsert-record-params.type';
+import { getSelectedColumnsFromRestrictedFields } from 'src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util';
 import { RecordInputTransformerService } from 'src/engine/core-modules/record-transformer/services/record-input-transformer.service';
 import { type ToolOutput } from 'src/engine/core-modules/tool/types/tool-output.type';
 import { computeCompositeColumnName } from 'src/engine/metadata-modules/field-metadata/utils/compute-column-name.util';
@@ -135,13 +136,28 @@ export class UpsertRecordService {
         )
         .filter(isDefined);
 
-      const upsertResult = await repository.upsert(transformedObjectRecord, {
-        conflictPaths: conflictPaths,
-        indexPredicate:
-          indexPredicate.length > 0
-            ? `${indexPredicate.join(' AND ')}`
-            : undefined,
-      });
+      const restrictedFields =
+        repository.objectRecordsPermissions?.[
+          objectMetadataItemWithFieldsMaps.id
+        ]?.restrictedFields;
+
+      const selectedColumns = getSelectedColumnsFromRestrictedFields(
+        restrictedFields,
+        objectMetadataItemWithFieldsMaps,
+      );
+
+      const upsertResult = await repository.upsert(
+        transformedObjectRecord,
+        {
+          conflictPaths: conflictPaths,
+          indexPredicate:
+            indexPredicate.length > 0
+              ? `${indexPredicate.join(' AND ')}`
+              : undefined,
+        },
+        undefined,
+        selectedColumns,
+      );
 
       const upsertedRecordId = upsertResult.identifiers?.[0].id;
 
@@ -156,6 +172,7 @@ export class UpsertRecordService {
         where: {
           id: upsertedRecordId,
         },
+        select: selectedColumns,
       });
 
       if (!upsertedRecord) {
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-input.zod-schema.ts b/packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-create-record-input-schema.util.ts
similarity index 79%
rename from packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-input.zod-schema.ts
rename to packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-create-record-input-schema.util.ts
index e98f7abd88..3e9e828b5a 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-input.zod-schema.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-create-record-input-schema.util.ts
@@ -1,14 +1,17 @@
+import { type RestrictedFieldsPermissions } from 'twenty-shared/types';
 import { z } from 'zod';
 
 import { generateRecordPropertiesZodSchema } from 'src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema';
 import { type ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
 
-export const generateRecordInputSchema = (
+export const generateCreateRecordInputSchema = (
   objectMetadata: ObjectMetadataEntity,
+  restrictedFields?: RestrictedFieldsPermissions,
 ) => {
   const recordPropertiesSchema = generateRecordPropertiesZodSchema(
     objectMetadata,
     false,
+    restrictedFields,
   );
 
   return z.object({
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-update-record-input-schema.util.ts b/packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-update-record-input-schema.util.ts
new file mode 100644
index 0000000000..65e014deab
--- /dev/null
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/utils/generate-update-record-input-schema.util.ts
@@ -0,0 +1,33 @@
+import { type RestrictedFieldsPermissions } from 'twenty-shared/types';
+import { z } from 'zod';
+
+import { generateRecordPropertiesZodSchema } from 'src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema';
+import { type ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
+
+export const generateUpdateRecordInputSchema = (
+  objectMetadata: ObjectMetadataEntity,
+  restrictedFields?: RestrictedFieldsPermissions,
+) => {
+  const recordPropertiesSchema = generateRecordPropertiesZodSchema(
+    objectMetadata,
+    false,
+    restrictedFields,
+  );
+
+  const updateSchema = recordPropertiesSchema.partial().extend({
+    id: z.string().uuid({
+      message:
+        'The unique identifier (UUID) of the record to update. This is required to identify which record should be modified.',
+    }),
+  });
+
+  return z.object({
+    loadingMessage: z
+      .string()
+      .optional()
+      .describe(
+        'A clear, human-readable description of the action being performed. Explain what operation you are executing and with what parameters in natural language.',
+      ),
+    input: updateSchema,
+  });
+};
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util.ts b/packages/twenty-server/src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util.ts
new file mode 100644
index 0000000000..2f90913126
--- /dev/null
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/utils/get-selected-columns-from-restricted-fields.util.ts
@@ -0,0 +1,23 @@
+import isEmpty from 'lodash.isempty';
+import { type RestrictedFieldsPermissions } from 'twenty-shared/types';
+
+import { getAllSelectableFields } from 'src/engine/api/utils/get-all-selectable-fields.utils';
+import { type ObjectMetadataItemWithFieldMaps } from 'src/engine/metadata-modules/types/object-metadata-item-with-field-maps';
+
+export const getSelectedColumnsFromRestrictedFields = (
+  restrictedFields: RestrictedFieldsPermissions | undefined,
+  objectMetadataItemWithFieldsMaps: ObjectMetadataItemWithFieldMaps,
+): string[] | undefined => {
+  if (!restrictedFields || isEmpty(restrictedFields)) {
+    return undefined;
+  }
+
+  const selectableFields = getAllSelectableFields({
+    restrictedFields,
+    objectMetadata: {
+      objectMetadataMapItem: objectMetadataItemWithFieldsMaps,
+    },
+  });
+
+  return Object.keys(selectableFields).filter((key) => selectableFields[key]);
+};
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema.ts b/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema.ts
index 0a41669bb4..e2e1eee163 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/find-tool.zod-schema.ts
@@ -1,12 +1,14 @@
+import { type RestrictedFieldsPermissions } from 'twenty-shared/types';
 import { z } from 'zod';
 
-import { ObjectRecordOrderBySchema } from 'src/engine/core-modules/record-crud/zod-schemas/order-by.zod-schema';
 import { generateFieldFilterZodSchema } from 'src/engine/core-modules/record-crud/zod-schemas/field-filters.zod-schema';
-import { type ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
+import { ObjectRecordOrderBySchema } from 'src/engine/core-modules/record-crud/zod-schemas/order-by.zod-schema';
 import { shouldExcludeFieldFromAgentToolSchema } from 'src/engine/metadata-modules/field-metadata/utils/should-exclude-field-from-agent-tool-schema.util';
+import { type ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
 
 export const generateFindToolInputSchema = (
   objectMetadata: ObjectMetadataEntity,
+  restrictedFields?: RestrictedFieldsPermissions,
 ) => {
   const filterShape: Record<string, z.ZodTypeAny> = {};
 
@@ -15,6 +17,10 @@ export const generateFindToolInputSchema = (
       return;
     }
 
+    if (restrictedFields?.[field.id]?.canRead === false) {
+      return;
+    }
+
     const filterSchema = generateFieldFilterZodSchema(field);
 
     if (filterSchema) {
diff --git a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema.ts b/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema.ts
index 3d34522196..d4bef4856a 100644
--- a/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema.ts
+++ b/packages/twenty-server/src/engine/core-modules/record-crud/zod-schemas/record-properties.zod-schema.ts
@@ -1,6 +1,9 @@
-import { z } from 'zod';
-import { FieldMetadataType } from 'twenty-shared/types';
+import {
+  FieldMetadataType,
+  type RestrictedFieldsPermissions,
+} from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
+import { z } from 'zod';
 
 import {
   type FieldMetadataSettings,
@@ -74,6 +77,7 @@ const getFieldZodType = (field: FieldMetadataEntity): z.ZodTypeAny => {
 export const generateRecordPropertiesZodSchema = (
   objectMetadata: ObjectMetadataEntity,
   forResponse = false,
+  restrictedFields?: RestrictedFieldsPermissions,
 ): z.ZodObject<Record<string, z.ZodTypeAny>> => {
   const shape: Record<string, z.ZodTypeAny> = {};
 
@@ -85,6 +89,10 @@ export const generateRecordPropertiesZodSchema = (
       return;
     }
 
+    if (restrictedFields?.[field.id]?.canUpdate === false) {
+      return;
+    }
+
     if (
       isFieldMetadataEntityOfType(field, FieldMetadataType.RELATION) &&
       field.settings?.relationType === RelationType.MANY_TO_ONE