Location Object: Why does creating a record require Edit permission?

I'm investigating a platform level behaviour with the standard Location

 object and wanted to share my findings to see if anyone else has encountered this. 

The Issue 

Users with the following object permissions:

• Read = Enabled
• Create = Enabled
• Edit = Disabled

Cannot create Location records. Record creation fails with:

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY

As soon as we grant Edit

 permission on the Location object, the same users can create records successfully. 

Troubleshooting Performed 

To isolate the problem, we:

• Disabled all Record-Triggered Flows
• Disabled all Apex Triggers (including managed package triggers where possible)
• Attempted creation with only the required Name field populated
• Removed all references to related records and lookup fields
• Verified consistent reproduction across multiple test users

Even under these minimal conditions, Create permission alone is insufficient. 

My Hypothesis

While reviewing the Location object documentation, I noticed the 

RootLocationId field (Read-only Lookup to Location) is populated with the Id of the Location record itself (self-reference) when a Location has no parent (ParentLocationId is null). 

 Since a record's Id is not available until the record is saved to database (not committed), any platform process that maintains fields dependent on the newly generated Id must execute in the after context 

(context in which the fields of the record itself are no longer editable). 

My hypothesis is that Salesforce performs an internal update operation after the insert to populate RootLocationId with the newly created record's Id. If this internal update runs in the same transaction and in the current user context, it would require Edit permission on the Location object—even though the user is only attempting to create a new record.  

Why I think this happens: 

1. RootLocationId is a read-only, system-maintained field
2. The field references the Location's own Id (when no parent exists)
3. Record Ids are only available in after-insert context
4. The error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY typically indicates insufficient permissions on a cross-referenced record
5. In this case, the "cross-reference" may be the Location record itself during the internal update

Has anyone experienced the same behavior with the standard Location object? Is there any documented platform behaviour related to RootLocationId or Location hierarchy management that could explain this?