How to enforce that a sensitive custom field on Case is visible only to support managers using permission sets while keeping the field accessible to automation.