Close out last week’s timesheets for good. Three small flows, one custom permission, no code.

Once a week or month is closed, most teams want it to stay closed. Invoices go out, reports get shared with leadership, and nobody wants a timesheet quietly changing a month later. Resource Hero does not lock past time entries out of the box, but Salesforce Flow makes it a short afternoon project.

This article walks through a setup that:

• Blocks users from logging, changing, or deleting hours dated before a cutoff you choose.
• Lets you pick the cutoff rule with one setting: a rolling number of days, the start of the current week, or the start of the current month.
• Leaves PTO, holiday, and capacity rows alone.
• Gives admins and project managers a bypass so corrections are still possible.

Everything is standard Salesforce configuration. You will create one custom permission, one permission set, one formula field, and three record-triggered flows.

Prefer to skip the clicking? The complete setup is on GitHub at Resource-Hero/rh-time-entry-lock, ready to deploy with the Salesforce CLI. It includes an Apex test class that proves the lock behaves as described in your own org. Deploy it, then use this article as the reference for what each piece does.

How it works

Resource Hero stores every day’s hours on a Resource Forecast record. The Time Tracker, the Matrix, and the Tap Tracking buttons all write to that object, so a flow on Resource Forecast catches every path a user can take.

We build three before-save flows on Resource Forecast, one per operation:

Flow	Trigger	What it blocks
RH Lock Time Entries – Create	A record is created	Logging hours on a date before the cutoff
RH Lock Time Entries – Update	A record is updated	Changing hours or notes on a locked entry
RH Lock Time Entries – Delete	A record is deleted	Removing a locked entry

Each flow asks two questions. Does this user have the bypass permission? If not, which lock rule applies to this entry’s date? If the date falls before the cutoff, a Custom Error element stops the save and shows the user a clear message.

Salesforce requires a separate flow for delete triggers, and keeping create and update separate lets each one use the right entry conditions. The three flows share the same resources and the same decision logic, so you build one and clone it twice.

Step 1: Create the bypass custom permission

Someone always needs to fix a locked entry. Rather than deactivating flows, give trusted users a custom permission the flows check for.

1. In Setup, search for Custom Permissions and click New.
2. Set the label to Edit Locked Time Entries. The API name becomes Edit_Locked_Time_Entries.
3. Add a description so the next admin knows what it does, then save.

Now put it in a permission set so you can assign it:

1. In Setup, go to Permission Sets and click New.
2. Name it Time Entry Lock Bypass and save.
3. Open Custom Permissions, click Edit, and add Edit Locked Time Entries.
4. Assign the permission set to your admins and anyone who approves timesheets.

Step 2: Add a helper formula field

Resource Hero uses Resource Forecast rows for more than project time. PTO, holidays, and capacity are stored on the same object, tied to special Resource Assignments. The Resource Assignment has an Is Standard checkbox that is true only for regular project work, and that is the flag we want.

A before-save flow cannot read a parent record’s field in its entry conditions, so we mirror the flag onto Resource Forecast with a formula field:

1. In Object Manager, open Resource Forecast, then Fields & Relationships, and click New.
2. Choose Formula, then Checkbox.
3. Label it Is Standard Assignment. The API name becomes Is_Standard_Assignment__c.
4. Enter this formula:

ResourceHeroApp__Resource_Assignment__r.ResourceHeroApp__Is_Standard__c

5. Grant read access to your admin profile so the field shows up in Flow Builder, then save.

Step 3: Build the Update flow

Start with the Update flow, since it is the one users hit most often.

Start element

1. In Setup, open Flows and click New Flow. Choose Record-Triggered Flow.
2. Object: Resource Forecast.
3. Trigger: A record is updated.
4. Optimize for: Fast Field Updates.

Under Set Entry Conditions, choose Custom Condition Logic Is Met and enter 1 AND (2 OR 3):

#	Field	Operator	Value
1	Is Standard Assignment	Equals	True
2	Actual	Is Changed	True
3	Actual Notes	Is Changed	True

The entry conditions do two jobs. Condition 1 keeps PTO and holiday rows out of the flow entirely. Conditions 2 and 3 mean the flow only runs when someone actually touches the hours or notes, so rate recalculations and other background updates pass through untouched.

Resources

Open the Toolbox and create these resources. They live inside the flow, so you will get them for free when you clone it.

Constants

API Name	Type	Default	Purpose
LockMode	Text	Week	Which rule applies. One of Days, Week, or Month.
LockDays	Number	7	Only used when LockMode is Days.

Formulas (all of type Date)

API Name	Formula	Result
Cutoff_Rolling_Days	TODAY() - {!LockDays}	Today minus N days
Cutoff_This_Week	TODAY() - MOD(TODAY() - DATE(1900, 1, 8), 7)	Monday of the current week
Cutoff_This_Month	DATE(YEAR(TODAY()), MONTH(TODAY()), 1)	First day of the current month

The week formula is the same one Resource Hero uses for its own Week Beginning field, so the two always agree. If your week starts on Sunday, change DATE(1900, 1, 8) to DATE(1900, 1, 7).

Decision 1: Can this user edit locked entries?

Add a Decision element right after Start.

• Label: Can this user edit locked entries?
• Outcome No – enforce lock: {!$Permission.Edit_Locked_Time_Entries} Equals False
• Default outcome, relabeled Yes – has bypass permission: connects straight to End

Anyone holding the custom permission exits here and the save goes through normally.

Decision 2: Which lock rule applies?

On the No – enforce lock path, add a second Decision with three outcomes. Each outcome checks the mode and the date together, so only the active rule can fire.

Outcome	Condition 1	Condition 2
Older than N days	LockMode Equals Days	Forecast Date Less Than Cutoff_Rolling_Days
Before this week	LockMode Equals Week	Forecast Date Less Than Cutoff_This_Week
Before this month	LockMode Equals Month	Forecast Date Less Than Cutoff_This_Month

Relabel the default outcome Not locked and leave it connected to End.

Custom Error elements

Add a Custom Error element on each of the three locked outcomes. Keep the message under 255 characters and include the date so users know exactly which entry was refused. For the “Before this week” outcome:

Locked: the entry dated {!$Record.ResourceHeroApp__ForecastDate__c} is before this week ({!Cutoff_This_Week}). You can no longer change hours or notes on it. Contact your administrator if it needs correcting.

Choose In a window on a record page so the error shows as a banner rather than being tied to a field. Write the other two messages the same way, swapping in {!LockDays} or {!Cutoff_This_Month}.

Save the flow as RH Lock Time Entries – Update and activate it.

Step 4: Clone for Create and Delete

Use Save As to make two copies. Only the Start element changes.

RH Lock Time Entries – Create

• Trigger: A record is created
• Entry conditions (all must be true): Is Standard Assignment Equals True, Actual Is Null False, Actual Not Equal To 0
• Error wording: “You can no longer log hours against it.”

RH Lock Time Entries – Delete

• Trigger: A record is deleted
• Entry conditions: same as Create
• Error wording: “You can no longer delete hours from it.”

The Actual conditions matter. Resource Hero creates and removes empty Resource Forecast rows as part of forecasting, and those should never be blocked. Only rows that carry real hours are protected.

Activate both. The Flow Trigger Explorer for Resource Forecast should now show one before-save flow for each of create, update, and delete.

Step 5: Choose your lock rule

The whole setup is controlled by the LockMode constant. Open each flow, edit the constant, and save a new version:

• Week locks everything before Monday of the current week. Good for weekly timesheet approval.
• Month locks everything before the first of the current month. Good for monthly invoicing.
• Days with LockDays set to 7 (or any number) gives a rolling grace period. Good for teams that log a little late but never a lot late.

Because the three flows are independent, you could even mix rules, for example a rolling 3-day window on deletes and a monthly lock on edits.

What users see

When someone tries to log time in a closed period, the Time Tracker shows the flow’s message immediately and nothing is saved.

The same message appears in the Matrix, on the Resource Forecast record page, and in any data load, because the check runs on the record rather than in the interface.

Things to know

• Timers that cross the cutoff. A timer started on Friday and stopped on Monday writes to Friday’s row. If Friday is now locked, the stop will fail for users without the bypass. Ask people to stop timers before the week closes.
• Time zones. TODAY() in a flow uses the running user’s time zone, so the cutoff moves with each user. For a distributed team, that is usually what you want.
• Bulk corrections. Assign the bypass permission set before a data load or import, then remove it afterward. Do not deactivate the flows.
• Sandboxes first. Build and test in a sandbox, then deploy the field, custom permission, permission set, and flows together as a change set or package. If you deploy from the GitHub repo, run the included test class in the sandbox before you promote.
• Mandatory notes. If you also want to require a note on every time entry, a validation rule on Resource Forecast handles that. We cover it in a separate article.

Get started

• Read about the Resource Forecast object to understand the fields these flows check.
• Review the Time Tracker documentation for how hours get written.
• Deploy the ready-made version from GitHub if you would rather not build the flows by hand.
• Contact support if you would like us to review your flows before you activate them in production.

Ready to get started? Schedule a call with the Resource Hero team and we will walk through the setup with you.