you hit the nail on the head.
There are two settings for the field;
"Include Condition:"
and
"Hide Condition:"
The important thing to "get" is that they are not opposites of each other.
"Include" determines if the field appears on the form or not. An un-included field cannot be hidden or unhidden - it simply does not exist. The user cannot right-click on the page and inspect source to see it's current value. It will not be part of the POST when they click on Save.
"Hide" is used for fields that _are_ on the page. It's a cosmetic convenience. the field is still on the page, and the user can "see" it if they know how to manipulate the browser. Thus hide is not suitable as a security method. The field will also be part of the POST, hidden or not.
Cheers
Bruce