new with a *custom* record protection entry
(id: RecordIdentifier, record: R, key: &PCSZoneConfig, update: Option<String>)
source not stored for this graph (policy: none)
nothing calls this directly
no test coverage detected