A create form can prefill values from fields the user is not allowed to read

"Duplicate as draft" and "create from template" endpoints often load the source record, copy every column into the new draft, and return that payload to the create form. Field-level read rules on the