Thank you v.much Eric

That is a good idea, it is simple to understand. I went for the permissions in the end.

All new data is protected. I can still login with admin rights and fix old records. Trigger would have to be disabled for me to do fixes.

I like your idea, because the environment they use to do ad-hoc queries they couldn't call checksum func. So allows fixes but stops any new errors.

I hope I remember this checksum computed column for future next time I need something similar.