Is it possible to restrict an agent to only adding new records, without allowing them to modify or delete existing ones?

Not with a strict create-only API key today. Busabase offers a proposal-only permission level: the agent can submit changes for human review and cannot merge them itself, but that level does not prevent it from proposing an update or deletion.

For your follow-up workflow, a controlled Form submission link or your own narrow server endpoint can accept new follow-up records without exposing a general Base API key to the agent. Keep the customer Base out of that submission path and have the team review the new follow-ups before approval. If the agent holds a normal API key, do not treat a prompt saying “only add” as an enforced permission rule. We have recorded the request for a true add-only permission. Do you need updates/deletions to be rejected at submission time, or is human review before they take effect sufficient?