I've been wrestling with this for a while but don't know much about external sourcing and can't find a suitable solution. What I want to do is to have two separate databases such that one sources data from another.

database A: where users will be free to manipulate a core set of data.

database B: where whole tables of data are sourced from database A and cannot be changed. other tables and layouts can be built as needed off of this core.

I would appreciate some words of Filemaker wisdom.

To what end this madness be? :

Don't over-think the concept of external data sources. It allows tables from one file to be displayed in another file -- a data file and an interface file.

The access permissions can be set up so the data from the data file cannot be changed but the layouts can be added at will and modified in the interface file.

Is that what you're thinking of?

It sounds like you are looking at "the separation model" with your user account permissions such that some users have full access to the UserInterface.fp7 file and more restricted access to the Data.fp7 database.

Yeah pretty much. I just need it to work so that both databases can contain their own different layouts and tables.

To clarify, this is for two separate research labs. Both labs use the same core set of data with which to frame research projects, but only one of the labs should be able to modify this core data. Apart from the core, each database should be able to operate independently of the other. I want it to be possible for a user from the group that is not able to modify the data to still be able to have full access to their own database.

or even more simply: can I make an external data source view-only?

You can control who can view or edit data through record access privileges.

I have tried this before. External data sources do not show up in the record access privilege menu.

When a person uses a database they will need to authenticate to open it. So both the "data" and "interface" files need to have accounts set up for the users. If both files have accounts with the same username and password then the user will only be prompted to authenticate once to open the first file. After that, the files will be opened automatically as needed with the same username and password.

To get what you want, the user account would have read-only privileges in the data file, but have more access (possibly full access) in the interface file.

The accounts and privileges have to be set up in each file the user will be accessing. So in the data file set up the account and privilege set to allow read only. In the interface file set up the account and privilege set to allow permissions to edit layouts etc.

As Vaughan explained, the privileges of each file are independent, you have to set them up in each file separately.

In practice this means that if you run a script in the UI file, e.g. to delete a record, even if you click the "run with full access privileges" checkbox, that record won't be deleted in the data file if the user doesn't have those privileges assigned in the data file.

What you have to do is create a "delete record" script in the *data* file that runs with full privileges, and call that script from the UI file when you want a low-level user to have that ability.