Resource access control

Some objects that are loaded by the Management Center framework should not be edited by a business user. Mark these objects as read-only by adding readonly="true" to the serialized object. For example, active promotions can be viewed, but not changed.

The read-only state of a child object is inherited from its parent object, but can be overridden if the child object has a different read-only state from its parent. Primary objects do not inherit the read-only state of the reference objects that reference them.