Restricting Prefix Creation to Custom Scripts Only

[schlrech]

Hello Community,
we're currently using custom scripts to automate the creation of prefixes. Our goal is to enforce that prefixes can only be created via custom scripts — not manually via the GUI.

However, I'm having trouble with the permission settings.

If we remove prefix creation permissions from a group, but then grant access to custom scripts in another group — and users are members of both — the permissions are cumulative. This allows them to still create prefixes manually via the GUI, which we want to avoid.

Is there a way to restrict users from creating prefixes manually, while still allowing the custom script to run with the necessary permissions?

Any advice on how to properly structure these permissions would be appreciated.

Thanks in advance!