IMHO, almost all forms should start as read-only. A button should turn on editing mode. A save should be explicit. I know, the MS guys did it their way in Access, ignoring best practices that had been established for decades, mostly because of their ignorance or hubris.

Anything that alters the appearance/function of a form for a given user should be based on the users' permissions after they have logged in. Including the ability to edit. The only place for a password in an application is at login.

I know, I know Richard; you're helping those that are patching legacy designs and systems. Just something to think about for them.