Using an XML definition file, you can set view, edit, create and delete permissions for any UpStream object, as well as individual fields.
Want to hide a field from certain users? You can do it with UpStream Advanced Permissions.
Want to make certain objects read-only? You can do that too.