I have a custom record in my bundle that we have locked (since I believe that is the standard practice, and we don't want our customers messing with the custom record) however, locking that record also locks the permissions, and a customer wants to restrict which users can see these custom records. Is there a standard practice for how to go about allowing a bundle user to control who sees the custom records in the bundle without needing to unlock the whole bundle? I already have a custom permissions role to view the record but do I need to make a role that specifically cant?