diff --git a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLock.java b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLock.java
index 9902307a..6cf99e9e 100644
--- a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLock.java
+++ b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLock.java
@@ -129,8 +129,9 @@ public class RecordSecurityLock implements Cloneable
     *******************************************************************************/
    public enum LockScope
    {
-      READ_AND_WRITE,
-      WRITE
+      READ_AND_WRITE, // lock both reads and writes
+      WRITE, // only lock writes
+      READ // only lock reads
    }
 
 
diff --git a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLockFilters.java b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLockFilters.java
index 4d5ad71b..c3eccc7e 100644
--- a/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLockFilters.java
+++ b/qqq-backend-core/src/main/java/com/kingsrook/qqq/backend/core/model/metadata/security/RecordSecurityLockFilters.java
@@ -52,7 +52,7 @@ public class RecordSecurityLockFilters
     *******************************************************************************/
    public static MultiRecordSecurityLock filterForReadLockTree(List<RecordSecurityLock> recordSecurityLocks)
    {
-      return filterForLockTree(recordSecurityLocks, Set.of(RecordSecurityLock.LockScope.READ_AND_WRITE));
+      return filterForLockTree(recordSecurityLocks, Set.of(RecordSecurityLock.LockScope.READ_AND_WRITE, RecordSecurityLock.LockScope.READ));
    }
 
 
@@ -88,7 +88,7 @@ public class RecordSecurityLockFilters
       {
          if(recordSecurityLock instanceof MultiRecordSecurityLock multiRecordSecurityLock)
          {
-            MultiRecordSecurityLock filteredSubLock = filterForReadLockTree(multiRecordSecurityLock.getLocks());
+            MultiRecordSecurityLock filteredSubLock = filterForLockTree(multiRecordSecurityLock.getLocks(), allowedScopes);
             filteredSubLock.setOperator(multiRecordSecurityLock.getOperator());
             result.withLock(filteredSubLock);
          }