Situation

We have some "external" users in our Phabricator instance, which are not linked to Active Directory accounts and thus not subject to our LDAP/Phabricator synchronisation scripts. We would like these users to have a limited, predefined lifetime and we would like to take note of which "internal" user brought them into the instance.

To support this, I set user.custom-field-definitions to:

"urz:policy:validuntil": {
  "name": "Valid Until",
  "type": "date",
  "caption": "Date until which the account is valid",
  "edit": false,
  "view": true
},
"urz:policy:incharge": {
  "name": "User In Charge",
  "type": "users",
  "caption": "User who is in charge of this user (e.g. supervisor, contact at URZ)",
  "edit": false,
  "view": true
}

I assume that setting "edit": false is enough to forbid the user from changing the field themselves?

Problem

I, as an administrator, can see the values the user set, but I cannot edit them, as that requires permission to edit the user's profile, which only the user themselves has.

Question

How do I, as the instance administrator set the field (using command line tools would be acceptable)?