Hi, I tried to don't allow users access into update page by using 'click to preview' in list config, but if they change the url from 'preview' to 'update', they can edit it. So, how can I set the permissions for update page? Thanks,

So you want the user to see the list of records for the model but accessing the record update form should be allowed only if user has permission, is that it?

You could override the controller's update method and check permissions there (see below) :

https://octobercms.com/docs/backend/forms#extend-form-behavior

https://octobercms.com/docs/backend/users#features

In addition, if you don't want the list records to be "clickable" when user has no permission to edit, use this code in your controller:

    public function listExtendColumns($list)
    {   
        if (! $this->user->hasPermission([ 'your-permission-code-here' ])) {
            $list->recordOnClick = false;
        }
    }   

Or this:

    public function listInjectRowClass($record)
    {
        if (! $this->user->hasPermission([ 'your-permission-code-here' ])) {
            return 'nolink';
        }
    }   

Thanks for your supporting, Mr. mjauvin. I have successfully completed it.