diff --git a/pipeline/src/client/CreatePipelineTrigger/CreatePipelineTrigger.tsx b/pipeline/src/client/CreatePipelineTrigger/CreatePipelineTrigger.tsx
index 818caa8cb85..473c9d80f19 100644
--- a/pipeline/src/client/CreatePipelineTrigger/CreatePipelineTrigger.tsx
+++ b/pipeline/src/client/CreatePipelineTrigger/CreatePipelineTrigger.tsx
@@ -7,7 +7,6 @@ import React, { ChangeEvent, Dispatch, FC, Reducer, useCallback, useEffect, useR
 import { ActionURL, Ajax, Utils } from '@labkey/api';
 import { Alert, AutoForm, cancelEvent, FormSchema, naturalSort, redirect } from '@labkey/components';
 
-// eslint-disable-next-line import/no-unassigned-import
 import './CreatePipelineTrigger.scss';
 
 const HELP_TEXT = 'Fields marked with an asterisk * are required. ';
@@ -36,7 +35,7 @@ interface TriggerConfiguration {
     rowId: number;
 }
 
-type CustomConfiguration = Record<string, string | boolean>;
+type CustomConfiguration = Record<string, boolean | string>;
 
 interface CustomParameterModel {
     id: number; // used internally as a key for react
@@ -74,13 +73,13 @@ interface FormState {
 // The omitted fields are computed by initializeFormState
 type InitialState = Omit<
     FormState,
-    | 'customParameters'
     | 'customConfigValid'
+    | 'customParameters'
     | 'detailsValid'
     | 'isDirty'
     | 'saveError'
-    | 'saving'
     | 'saveSuccessful'
+    | 'saving'
     | 'triggerConfigValid'
 >;
 
@@ -98,7 +97,7 @@ enum ActionType {
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 interface FieldAction<T = any> {
     field: string;
-    type: ActionType.UPDATE_DETAILS | ActionType.UPDATE_TRIGGER_CONFIG | ActionType.UPDATE_CUSTOM_CONFIG;
+    type: ActionType.UPDATE_CUSTOM_CONFIG | ActionType.UPDATE_DETAILS | ActionType.UPDATE_TRIGGER_CONFIG;
     value: T;
 }
 
@@ -131,12 +130,12 @@ interface SetSavingAction {
 }
 
 type FormStateAction =
-    | FieldAction
-    | ViewAction
     | AddCustomParamAction
+    | FieldAction
     | RemoveCustomParamAction
+    | SetSavingAction
     | UpdateCustomParamAction
-    | SetSavingAction;
+    | ViewAction;
 
 const validateValues = (formSchema: FormSchema, values: Record<string, any>): boolean => {
     // Not every trigger type has a custom form schema, so this can be null/undefined.
@@ -162,6 +161,29 @@ const validateValues = (formSchema: FormSchema, values: Record<string, any>): bo
 
 const formStateReducer = (state: FormState, action: FormStateAction): FormState => {
     switch (action.type) {
+        case ActionType.ADD_CUSTOM_PARAM: {
+            const { customParameters } = state;
+            const integerIds = Object.keys(customParameters).map(k => parseInt(k, 10));
+            const id = integerIds.length > 0 ? Math.max(...integerIds) + 1 : 0;
+            return {
+                ...state,
+                customParameters: {
+                    ...customParameters,
+                    [id]: { key: '', value: '', id },
+                },
+                isDirty: true,
+            };
+        }
+        case ActionType.REMOVE_CUSTOM_PARAM: {
+            const { id } = action;
+            const customParameters = { ...state.customParameters };
+            delete customParameters[id];
+            return { ...state, customParameters, isDirty: true };
+        }
+        case ActionType.SET_SAVING: {
+            const { saving, saveError, saveSuccessful } = action;
+            return { ...state, saving, saveError, saveSuccessful };
+        }
         case ActionType.SET_VIEW: {
             // Don't navigate to the Configuration form if the user hasn't filled out the required fields in Details.
             if (!state.detailsValid) {
@@ -170,6 +192,36 @@ const formStateReducer = (state: FormState, action: FormStateAction): FormState
 
             return { ...state, view: action.view };
         }
+        case ActionType.UPDATE_CUSTOM_CONFIG: {
+            const customConfig = { ...state.customConfig, [action.field]: action.value };
+            const formSchema = state.customFieldFormSchemas[state.details.pipelineId];
+            return {
+                ...state,
+                isDirty: true,
+                customConfig,
+                customConfigValid: validateValues(formSchema, customConfig),
+            };
+        }
+        case ActionType.UPDATE_CUSTOM_PARAM: {
+            const { customParameters } = state;
+            const { id, key, value } = action;
+            const keyIsSame = customParameters[id].key === key;
+            const valueIsSame = customParameters[id].value === value;
+
+            if (keyIsSame && valueIsSame) {
+                // If nothing changed, no-op.
+                return state;
+            }
+
+            return {
+                ...state,
+                customParameters: {
+                    ...customParameters,
+                    [id]: { key, value, id },
+                },
+                isDirty: true,
+            };
+        }
         case ActionType.UPDATE_DETAILS: {
             const { customConfig, customFieldFormSchemas, details, taskFormSchemas, triggerConfig } = state;
             const { field, value } = action;
@@ -180,7 +232,6 @@ const formStateReducer = (state: FormState, action: FormStateAction): FormState
             if (field === 'pipelineId') {
                 // Set default values on the customConfig based on the appropriate FormSchema.
                 resetCustomConfig = {};
-                // eslint-disable-next-line no-unused-expressions
                 customFieldFormSchemas[value]?.fields.forEach(f => {
                     if (f.defaultValue !== null) {
                         resetCustomConfig[f.name] = f.defaultValue;
@@ -193,6 +244,10 @@ const formStateReducer = (state: FormState, action: FormStateAction): FormState
 
                 if (taskFormSchema) {
                     Object.keys(resetTriggerConfig).forEach(key => {
+                        // parameterFunction isn't task-specific, and users without permission must save it back
+                        // unchanged
+                        if (key === 'parameterFunction') return;
+
                         if (taskFormSchema.fields.find(f => f.name === key) === undefined) {
                             delete resetTriggerConfig[key];
                         }
@@ -221,59 +276,6 @@ const formStateReducer = (state: FormState, action: FormStateAction): FormState
                 triggerConfigValid: validateValues(formSchema, triggerConfig),
             };
         }
-        case ActionType.UPDATE_CUSTOM_CONFIG: {
-            const customConfig = { ...state.customConfig, [action.field]: action.value };
-            const formSchema = state.customFieldFormSchemas[state.details.pipelineId];
-            return {
-                ...state,
-                isDirty: true,
-                customConfig,
-                customConfigValid: validateValues(formSchema, customConfig),
-            };
-        }
-        case ActionType.ADD_CUSTOM_PARAM: {
-            const { customParameters } = state;
-            const integerIds = Object.keys(customParameters).map(k => parseInt(k, 10));
-            const id = integerIds.length > 0 ? Math.max(...integerIds) + 1 : 0;
-            return {
-                ...state,
-                customParameters: {
-                    ...customParameters,
-                    [id]: { key: '', value: '', id },
-                },
-                isDirty: true,
-            };
-        }
-        case ActionType.REMOVE_CUSTOM_PARAM: {
-            const { id } = action;
-            const customParameters = { ...state.customParameters };
-            delete customParameters[id];
-            return { ...state, customParameters, isDirty: true };
-        }
-        case ActionType.UPDATE_CUSTOM_PARAM: {
-            const { customParameters } = state;
-            const { id, key, value } = action;
-            const keyIsSame = customParameters[id].key === key;
-            const valueIsSame = customParameters[id].value === value;
-
-            if (keyIsSame && valueIsSame) {
-                // If nothing changed, no-op.
-                return state;
-            }
-
-            return {
-                ...state,
-                customParameters: {
-                    ...customParameters,
-                    [id]: { key, value, id },
-                },
-                isDirty: true,
-            };
-        }
-        case ActionType.SET_SAVING: {
-            const { saving, saveError, saveSuccessful } = action;
-            return { ...state, saving, saveError, saveSuccessful };
-        }
         default: {
             // Throw error for unhandled actions.
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -425,10 +427,10 @@ const DetailsForm: FC<DetailsFormProps> = ({ dispatch, formState, onNext, return
             <AutoForm formSchema={detailsFormSchema} onChange={onChange} values={details} />
 
             <div className="pipeline-trigger-buttons">
-                <button type="button" className="btn btn-primary" disabled={!formState.detailsValid} onClick={onNext}>
+                <button className="btn btn-primary" disabled={!formState.detailsValid} onClick={onNext} type="button">
                     next
                 </button>
-                <a href={returnUrl} className="btn btn-default">
+                <a className="btn btn-default" href={returnUrl}>
                     cancel
                 </a>
             </div>
@@ -476,7 +478,7 @@ const CustomParameter: FC<CustomParameterProps> = ({ customParameter, remove, up
             </div>
 
             <div className="col-sm-1">
-                <button type="button" onClick={onRemoveClicked}>
+                <button onClick={onRemoveClicked} type="button">
                     <span className="fa fa-trash" />
                 </button>
             </div>
@@ -507,13 +509,14 @@ const CustomParameters: FC<CustomParametersProps> = ({ customParameters, dispatc
             {Object.keys(customParameters)
                 .sort(naturalSort)
                 .map(id => (
-                    <CustomParameter key={id} update={update} remove={remove} customParameter={customParameters[id]} />
+                    <CustomParameter customParameter={customParameters[id]} key={id} remove={remove} update={update} />
                 ))}
         </div>
     );
 };
 
 interface ConfigurationFormProps {
+    canEditParameterFunction: boolean;
     dispatch: Dispatch<FormStateAction>;
     formState: FormState;
     onBack: () => void;
@@ -522,7 +525,7 @@ interface ConfigurationFormProps {
 }
 
 const ConfigurationForm: FC<ConfigurationFormProps> = props => {
-    const { formState, dispatch, onBack, onSubmit, returnUrl } = props;
+    const { canEditParameterFunction, formState, dispatch, onBack, onSubmit, returnUrl } = props;
     const {
         customConfig,
         customConfigValid,
@@ -569,19 +572,21 @@ const ConfigurationForm: FC<ConfigurationFormProps> = props => {
 
                 {showAdvanced && (
                     <div className="advanced-settings">
-                        <div className="form-group">
-                            <label className="col-sm-3 control-label" htmlFor="parameter-function">
-                                Parameter Function
-                            </label>
-                            <div className="col-sm-9">
-                                <textarea
-                                    id="parameter-function"
-                                    className="form-control"
-                                    onChange={onParamFunctionChange}
-                                    value={parameterFunction === null ? '' : parameterFunction}
-                                />
+                        {canEditParameterFunction && (
+                            <div className="form-group">
+                                <label className="col-sm-3 control-label" htmlFor="parameter-function">
+                                    Parameter Function
+                                </label>
+                                <div className="col-sm-9">
+                                    <textarea
+                                        className="form-control"
+                                        id="parameter-function"
+                                        onChange={onParamFunctionChange}
+                                        value={parameterFunction === null ? '' : parameterFunction}
+                                    />
+                                </div>
                             </div>
-                        </div>
+                        )}
 
                         <CustomParameters customParameters={customParameters} dispatch={dispatch} />
                     </div>
@@ -589,13 +594,13 @@ const ConfigurationForm: FC<ConfigurationFormProps> = props => {
             </div>
 
             <div className="pipeline-trigger-buttons">
-                <button disabled={saveDisabled} type="button" className="btn btn-primary" onClick={onSubmit}>
+                <button className="btn btn-primary" disabled={saveDisabled} onClick={onSubmit} type="button">
                     save
                 </button>
-                <a href={returnUrl} className="btn btn-default">
+                <a className="btn btn-default" href={returnUrl}>
                     cancel
                 </a>
-                <button type="button" className="btn btn-default" onClick={onBack}>
+                <button className="btn btn-default" onClick={onBack} type="button">
                     back
                 </button>
             </div>
@@ -654,6 +659,7 @@ function savePipelineTrigger(formState: FormState): Promise<boolean> {
 }
 
 export interface Props {
+    canEditParameterFunction: boolean;
     customConfig: CustomConfiguration;
     customFieldFormSchemas: Record<string, FormSchema>;
     details: Details;
@@ -668,6 +674,7 @@ export interface Props {
 
 export const CreatePipelineTrigger: FC<Props> = props => {
     const {
+        canEditParameterFunction,
         customConfig,
         customFieldFormSchemas,
         details,
@@ -748,23 +755,23 @@ export const CreatePipelineTrigger: FC<Props> = props => {
                 <div className="list-group">
                     <a
                         className={`list-group-item ${view === View.DETAILS ? 'active' : ''}`}
-                        onClick={showDetails}
                         href="#"
+                        onClick={showDetails}
                     >
                         Details
                     </a>
 
                     <a
                         className={`list-group-item ${view === View.CONFIGURATION ? 'active' : ''}`}
-                        onClick={showConfig}
                         href="#"
+                        onClick={showConfig}
                     >
                         Configuration
                     </a>
                 </div>
 
                 <ul className="list-group">
-                    <a className="list-group-item" href={docsHref} target="_blank" rel="noopener noreferrer">
+                    <a className="list-group-item" href={docsHref} rel="noopener noreferrer" target="_blank">
                         Documentation &nbsp;
                         <span className="fa fa-external-link" />
                     </a>
@@ -782,6 +789,7 @@ export const CreatePipelineTrigger: FC<Props> = props => {
 
                 {view === View.CONFIGURATION && (
                     <ConfigurationForm
+                        canEditParameterFunction={canEditParameterFunction}
                         dispatch={dispatch}
                         formState={formState}
                         onBack={showDetails}
diff --git a/pipeline/src/org/labkey/pipeline/PipelineController.java b/pipeline/src/org/labkey/pipeline/PipelineController.java
index cd98a0ca7eb..4ee97903267 100644
--- a/pipeline/src/org/labkey/pipeline/PipelineController.java
+++ b/pipeline/src/org/labkey/pipeline/PipelineController.java
@@ -42,13 +42,17 @@
 import org.labkey.api.admin.AdminUrls;
 import org.labkey.api.admin.ImportException;
 import org.labkey.api.admin.ImportOptions;
+import org.labkey.api.collections.CaseInsensitiveHashMap;
 import org.labkey.api.collections.IntHashMap;
 import org.labkey.api.compliance.ComplianceService;
 import org.labkey.api.data.Container;
 import org.labkey.api.data.ContainerManager;
 import org.labkey.api.data.SimpleFilter;
 import org.labkey.api.data.Table;
+import org.labkey.api.data.TableInfo;
 import org.labkey.api.data.TableSelector;
+import org.labkey.api.dataiterator.DataIteratorContext;
+import org.labkey.api.dataiterator.MapDataIterator;
 import org.labkey.api.exp.property.DomainUtil;
 import org.labkey.api.files.FileContentService;
 import org.labkey.api.files.FilesAdminOptions;
@@ -67,8 +71,12 @@
 import org.labkey.api.pipeline.browse.PipelinePathForm;
 import org.labkey.api.pipeline.file.FileAnalysisTaskPipeline;
 import org.labkey.api.pipeline.view.SetupForm;
+import org.labkey.api.query.BatchValidationException;
 import org.labkey.api.query.FieldKey;
+import org.labkey.api.query.QueryService;
+import org.labkey.api.query.QueryUpdateService;
 import org.labkey.api.query.QueryUrls;
+import org.labkey.api.query.UserSchema;
 import org.labkey.api.security.Group;
 import org.labkey.api.security.MutableSecurityPolicy;
 import org.labkey.api.security.RequiresPermission;
@@ -86,6 +94,7 @@
 import org.labkey.api.security.permissions.ReadPermission;
 import org.labkey.api.security.permissions.UserManagementPermission;
 import org.labkey.api.security.roles.FolderAdminRole;
+import org.labkey.api.security.roles.PlatformDeveloperRole;
 import org.labkey.api.security.roles.Role;
 import org.labkey.api.security.roles.RoleManager;
 import org.labkey.api.settings.AdminConsole;
@@ -116,13 +125,13 @@
 import org.labkey.pipeline.api.PipeRootImpl;
 import org.labkey.pipeline.api.PipelineEmailPreferences;
 import org.labkey.pipeline.api.PipelineManager;
+import org.labkey.pipeline.api.PipelineQuerySchema;
 import org.labkey.pipeline.api.PipelineSchema;
 import org.labkey.pipeline.api.PipelineServiceImpl;
 import org.labkey.pipeline.api.PipelineStatusManager;
 import org.labkey.pipeline.status.StatusController;
 import org.labkey.vfs.FileLike;
 import org.springframework.beans.MutablePropertyValues;
-import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.validation.BindException;
 import org.springframework.validation.Errors;
 import org.springframework.web.servlet.ModelAndView;
@@ -132,6 +141,7 @@
 import java.nio.file.Files;
 import java.text.ParseException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -1442,6 +1452,13 @@ public ModelAndView getView(PipelineTriggerForm form, BindException errors)
                     throw new NotFoundException("Pipeline trigger with id " + rowId + " could not be found");
                 }
             }
+            else
+            {
+                // GH Issue 1524: don't let a crafted link plant a function in the collapsed Advanced Settings. The
+                // reset regenerates a bound raw "configuration" from the fields, now without the function.
+                form.setParameterFunction(null);
+                form.resetConfiguration();
+            }
 
             if (form.getReturnUrl() == null)
                 form.setReturnUrl(getContainer().getStartURL(getUser()).toString());
@@ -1789,5 +1806,358 @@ public void testSavePipelineTriggerContainerScoping() throws Exception
             JSONObject ownEdit = new JSONObject().put("rowId", rowId);
             assertStatus(HttpServletResponse.SC_BAD_REQUEST, postJson(ownUrl, admin, ownEdit));
         }
+
+        // An unregistered type keeps the update service from starting a listener for these rows.
+        private static final String TEST_TRIGGER_TYPE = "scoping-test-type";
+        private static final String PARAMETER_FUNCTION = "parameterFunction";
+        private static final String FUNCTION = "var x = 1;";
+        private static final String INVALID_JSON = "{not json";
+
+        @Test
+        public void testFolderAdminCanManageTriggerWithoutParameterFunction() throws Exception
+        {
+            Container c = createContainer("NoFunction");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+            assertFalse(folderAdmin.isTrustedAnalyst());
+
+            Map<String, Object> row = triggerRow(configJson(null));
+            assertNoErrors(insert(folderAdmin, c, row));
+            int rowId = rowIdByName(c, (String) row.get("Name"));
+
+            Map<String, Object> edit = keyRow(rowId);
+            edit.put("Description", "edited");
+            edit.put("Configuration", new JSONObject(configJson(null)).put("location", "./moved").toString());
+            assertNoErrors(update(folderAdmin, c, edit));
+            assertEquals("edited", storedRow(rowId).get("Description"));
+        }
+
+        @Test
+        public void testFolderAdminCannotInsertParameterFunction() throws Exception
+        {
+            Container c = createContainer("InsertFunction");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+
+            List<Object> configurations = List.of(
+                configJson(FUNCTION),
+                new JSONObject(configJson(FUNCTION)),
+                configJson(new JSONArray().put(FUNCTION))
+            );
+            for (Object configuration : configurations)
+            {
+                Map<String, Object> row = triggerRow(configuration);
+                assertTrue("Insert must be rejected: " + configuration, insert(folderAdmin, c, row).hasErrors());
+                assertFalse("No row may be written: " + configuration, triggerExists(c, (String) row.get("Name")));
+            }
+
+            // Table.insert may ignore an alias key rather than reject it; either way no function may be stored.
+            Map<String, Object> aliased = triggerRow(null);
+            aliased.remove("Configuration");
+            aliased.put(configurationPropertyURI(folderAdmin, c), configJson(FUNCTION));
+            insert(folderAdmin, c, aliased);
+            if (triggerExists(c, (String) aliased.get("Name")))
+                assertNull(storedFunction(rowIdByName(c, (String) aliased.get("Name"))));
+        }
+
+        @Test
+        public void testFolderAdminCannotChangeParameterFunction() throws Exception
+        {
+            Container c = createContainer("ChangeFunction");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+            int rowId = seedTrigger(c, FUNCTION);
+
+            List<Object> configurations = Arrays.asList(
+                configJson("var y = 2;"),
+                configJson(null),
+                configJson(""),
+                null,
+                new JSONObject(configJson("var y = 2;")),
+                configJson(new JSONArray().put(FUNCTION))
+            );
+            for (Object configuration : configurations)
+            {
+                Map<String, Object> edit = keyRow(rowId);
+                edit.put("Configuration", configuration);
+                assertTrue("Update must be rejected: " + configuration, update(folderAdmin, c, edit).hasErrors());
+                assertEquals("Function must be unchanged: " + configuration, FUNCTION, storedFunction(rowId));
+            }
+
+            Map<String, Object> aliased = keyRow(rowId);
+            aliased.put(configurationPropertyURI(folderAdmin, c), configJson("var y = 2;"));
+            assertTrue("Update via propertyURI must be rejected", update(folderAdmin, c, aliased).hasErrors());
+            assertEquals(FUNCTION, storedFunction(rowId));
+
+            int noFunctionRowId = seedTrigger(c, null);
+            Map<String, Object> add = keyRow(noFunctionRowId);
+            add.put("Configuration", configJson(FUNCTION));
+            assertTrue("Adding a function must be rejected", update(folderAdmin, c, add).hasErrors());
+            assertNull(storedFunction(noFunctionRowId));
+        }
+
+        @Test
+        public void testFolderAdminCanEditTriggerWithUnchangedParameterFunction() throws Exception
+        {
+            Container c = createContainer("UnchangedFunction");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+            int rowId = seedTrigger(c, FUNCTION);
+
+            // The wizard regenerates the whole Configuration, so other keys change around the unchanged function.
+            Map<String, Object> edit = keyRow(rowId);
+            edit.put("Description", "edited");
+            edit.put("Configuration", new JSONObject(configJson(FUNCTION)).put("location", "./moved").put("quiet", 5000).toString());
+            assertNoErrors(update(folderAdmin, c, edit));
+            assertEquals(FUNCTION, storedFunction(rowId));
+            assertEquals("./moved", new JSONObject((String) storedRow(rowId).get("Configuration")).getString("location"));
+
+            Map<String, Object> descriptionOnly = keyRow(rowId);
+            descriptionOnly.put("Description", "edited again");
+            assertNoErrors(update(folderAdmin, c, descriptionOnly));
+            assertEquals("edited again", storedRow(rowId).get("Description"));
+            assertEquals(FUNCTION, storedFunction(rowId));
+        }
+
+        @Test
+        public void testUpdateRowsContainerScoping() throws Exception
+        {
+            Container folderA = createContainer("UpdateA");
+            Container folderB = createContainer("UpdateB");
+            User adminA = createUserInRole(folderA, FolderAdminRole.class);
+            int rowId = seedTrigger(folderB, null);
+            String name = (String) storedRow(rowId).get("Name");
+
+            Map<String, Object> rename = keyRow(rowId);
+            rename.put("Name", "hacked");
+            Map<String, Object> rehome = keyRow(rowId);
+            rehome.put("Name", "hacked");
+            rehome.put("Container", folderA.getId());
+
+            for (User user : List.of(adminA, getAdmin()))
+            {
+                for (Map<String, Object> row : List.of(rename, rehome))
+                {
+                    assertTrue("Cross-container update must be rejected", update(user, folderA, new CaseInsensitiveHashMap<>(row)).hasErrors());
+                    assertUnchanged(rowId, name, folderB);
+                }
+            }
+
+            // Key supplied via oldKeys rather than the row
+            Map<String, Object> keyless = new CaseInsensitiveHashMap<>(Map.of("Name", "hacked"));
+            assertTrue("Cross-container update via oldKeys must be rejected", update(adminA, folderA, keyless, keyRow(rowId)).hasErrors());
+            assertUnchanged(rowId, name, folderB);
+        }
+
+        @Test
+        public void testTrustedAnalystCanManageParameterFunction() throws Exception
+        {
+            Container c = createContainer("TrustedFunction");
+            User developer = createUserInRole(c, FolderAdminRole.class);
+            grantRole(developer, ContainerManager.getRoot(), PlatformDeveloperRole.class);
+            assertTrue(developer.isTrustedAnalyst());
+
+            Map<String, Object> row = triggerRow(configJson(FUNCTION));
+            assertNoErrors(insert(developer, c, row));
+            int rowId = rowIdByName(c, (String) row.get("Name"));
+            assertEquals(FUNCTION, storedFunction(rowId));
+
+            Map<String, Object> change = keyRow(rowId);
+            change.put("Configuration", configJson("var y = 2;"));
+            assertNoErrors(update(developer, c, change));
+            assertEquals("var y = 2;", storedFunction(rowId));
+
+            Map<String, Object> clear = keyRow(rowId);
+            clear.put("Configuration", configJson(null));
+            assertNoErrors(update(developer, c, clear));
+            assertNull(storedFunction(rowId));
+        }
+
+        /** Trigger lookups parse both JSON columns of every matching row, so one invalid row breaks listener startup and management for all of them. */
+        @Test
+        public void testInvalidJsonRejectedForAllUsers() throws Exception
+        {
+            Container c = createContainer("InvalidJson");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+            User developer = createUserInRole(c, FolderAdminRole.class);
+            grantRole(developer, ContainerManager.getRoot(), PlatformDeveloperRole.class);
+
+            for (User user : List.of(folderAdmin, developer))
+            {
+                for (String column : List.of("Configuration", "CustomConfiguration"))
+                {
+                    Map<String, Object> row = triggerRow(configJson(null));
+                    row.put(column, INVALID_JSON);
+                    assertTrue(column + " must be valid JSON on insert", insert(user, c, row).hasErrors());
+                    assertFalse(triggerExists(c, (String) row.get("Name")));
+
+                    int rowId = seedTrigger(c, null);
+                    Map<String, Object> change = keyRow(rowId);
+                    change.put(column, INVALID_JSON);
+                    assertTrue(column + " must be valid JSON on update", update(user, c, change).hasErrors());
+                    assertNotEquals(INVALID_JSON, storedRow(rowId).get(column));
+                }
+            }
+        }
+
+        /** A stored Configuration that isn't valid JSON can't run a function, so a folder admin may replace it with one that has none. */
+        @Test
+        public void testFolderAdminCanRepairInvalidConfiguration() throws Exception
+        {
+            Container c = createContainer("RepairJson");
+            User folderAdmin = createUserInRole(c, FolderAdminRole.class);
+            int rowId = seedTrigger(c, null);
+            Table.update(getAdmin(), triggerTable(), new CaseInsensitiveHashMap<>(Map.of("Configuration", INVALID_JSON)), rowId);
+
+            Map<String, Object> withFunction = keyRow(rowId);
+            withFunction.put("Configuration", configJson(FUNCTION));
+            assertTrue("Repair must not add a function", update(folderAdmin, c, withFunction).hasErrors());
+            assertEquals(INVALID_JSON, storedRow(rowId).get("Configuration"));
+
+            Map<String, Object> repair = keyRow(rowId);
+            repair.put("Configuration", configJson(null));
+            assertNoErrors(update(folderAdmin, c, repair));
+            assertNull(storedFunction(rowId));
+        }
+
+        /** loadRows skips insertRow/updateRow, and with them the Parameter Function check and listener startup, so it's rejected for every caller. */
+        @Test
+        public void testLoadRowsRejectedInFavorOfInsertRows() throws Exception
+        {
+            Container c = createContainer("LoadRows");
+            User developer = createUserInRole(c, FolderAdminRole.class);
+            grantRole(developer, ContainerManager.getRoot(), PlatformDeveloperRole.class);
+            Map<String, Object> row = triggerRow(configJson(null));
+
+            // IMPORT backs the import action; MERGE backs ETL targets
+            for (QueryUpdateService.InsertOption option : List.of(QueryUpdateService.InsertOption.IMPORT, QueryUpdateService.InsertOption.MERGE))
+            {
+                DataIteratorContext context = new DataIteratorContext();
+                context.setInsertOption(option);
+                updateService(developer, c).loadRows(developer, c, MapDataIterator.of(List.of(row)), context, null);
+                assertTrue(option + " via loadRows must be rejected", context.getErrors().hasErrors());
+                assertFalse(triggerExists(c, (String) row.get("Name")));
+            }
+
+            assertNoErrors(insert(developer, c, row));
+            assertTrue(triggerExists(c, (String) row.get("Name")));
+        }
+
+        private static TableInfo triggerTable()
+        {
+            return PipelineSchema.getInstance().getTableInfoTriggerConfigurations();
+        }
+
+        private static QueryUpdateService updateService(User user, Container c)
+        {
+            UserSchema schema = QueryService.get().getUserSchema(user, c, PipelineQuerySchema.SCHEMA_NAME);
+            return schema.getTable(PipelineQuerySchema.TRIGGER_CONFIGURATIONS_TABLE_NAME).getUpdateService();
+        }
+
+        private static String configurationPropertyURI(User user, Container c)
+        {
+            UserSchema schema = QueryService.get().getUserSchema(user, c, PipelineQuerySchema.SCHEMA_NAME);
+            return schema.getTable(PipelineQuerySchema.TRIGGER_CONFIGURATIONS_TABLE_NAME).getColumn("Configuration").getPropertyURI();
+        }
+
+        private static String configJson(@Nullable Object parameterFunction)
+        {
+            JSONObject json = new JSONObject().put("location", "./");
+            if (parameterFunction != null)
+                json.put(PARAMETER_FUNCTION, parameterFunction);
+            return json.toString();
+        }
+
+        private static Map<String, Object> triggerRow(@Nullable Object configuration)
+        {
+            Map<String, Object> row = new CaseInsensitiveHashMap<>();
+            row.put("Name", "trigger-" + GUID.makeGUID());
+            row.put("Type", TEST_TRIGGER_TYPE);
+            row.put("PipelineId", "scoping-test-pipeline");
+            row.put("Enabled", false);
+            row.put("Configuration", configuration);
+            return row;
+        }
+
+        private static Map<String, Object> keyRow(int rowId)
+        {
+            return new CaseInsensitiveHashMap<>(Map.of("RowId", rowId));
+        }
+
+        /** Writes directly to the table, bypassing the update service under test. */
+        private int seedTrigger(Container c, @Nullable String parameterFunction)
+        {
+            TriggerConfiguration config = new TriggerConfiguration();
+            config.beforeInsert(getAdmin(), c.getId());
+            config.setName("trigger-" + GUID.makeGUID());
+            config.setType(TEST_TRIGGER_TYPE);
+            config.setPipelineId("scoping-test-pipeline");
+            config.setConfiguration(configJson(parameterFunction));
+            return Table.insert(getAdmin(), triggerTable(), config).getRowId();
+        }
+
+        private static BatchValidationException insert(User user, Container c, Map<String, Object> row) throws Exception
+        {
+            BatchValidationException errors = new BatchValidationException();
+            updateService(user, c).insertRows(user, c, List.of(row), errors, null, null);
+            return errors;
+        }
+
+        private static BatchValidationException update(User user, Container c, Map<String, Object> row) throws Exception
+        {
+            return update(user, c, row, null);
+        }
+
+        private static BatchValidationException update(User user, Container c, Map<String, Object> row, @Nullable Map<String, Object> oldKey) throws Exception
+        {
+            BatchValidationException errors = new BatchValidationException();
+            try
+            {
+                updateService(user, c).updateRows(user, c, List.of(row), oldKey == null ? null : List.of(oldKey), errors, null, null);
+            }
+            catch (BatchValidationException e)
+            {
+                return e;
+            }
+            return errors;
+        }
+
+        private static void assertNoErrors(BatchValidationException errors)
+        {
+            assertFalse(errors.getMessage(), errors.hasErrors());
+        }
+
+        private static boolean triggerExists(Container c, String name)
+        {
+            SimpleFilter filter = SimpleFilter.createContainerFilter(c).addCondition(FieldKey.fromParts("Name"), name);
+            return new TableSelector(triggerTable(), filter, null).exists();
+        }
+
+        private static int rowIdByName(Container c, String name)
+        {
+            SimpleFilter filter = SimpleFilter.createContainerFilter(c).addCondition(FieldKey.fromParts("Name"), name);
+            Integer rowId = new TableSelector(triggerTable().getColumn("RowId"), filter, null).getObject(Integer.class);
+            assertNotNull("Trigger " + name + " must exist", rowId);
+            return rowId;
+        }
+
+        private static Map<String, Object> storedRow(int rowId)
+        {
+            Map<String, Object> row = new TableSelector(triggerTable(), new SimpleFilter(FieldKey.fromParts("RowId"), rowId), null).getMap();
+            assertNotNull("Trigger " + rowId + " must exist", row);
+            return new CaseInsensitiveHashMap<>(row);
+        }
+
+        /** Extracts the function the way FileWatcherPipelineTriggerConfig does. */
+        private static @Nullable String storedFunction(int rowId)
+        {
+            Object configuration = storedRow(rowId).get("Configuration");
+            if (configuration == null)
+                return null;
+            return Objects.toString(new JSONObject(configuration.toString()).toMap().get(PARAMETER_FUNCTION), null);
+        }
+
+        private static void assertUnchanged(int rowId, String name, Container container)
+        {
+            Map<String, Object> row = storedRow(rowId);
+            assertEquals("Name must be unchanged", name, row.get("Name"));
+            assertEquals("Container must be unchanged", container.getId(), row.get("Container"));
+        }
     }
 }
diff --git a/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp b/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
index 8ded0205b78..ebe9b58bf36 100644
--- a/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
+++ b/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
@@ -112,6 +112,7 @@
         const returnUrl = <%=q(bean.getReturnActionURL().toString())%>;
 
         LABKEY.App.loadApp('createPipelineTrigger', <%=q(appId)%>, {
+            canEditParameterFunction: <%=getUser().isTrustedAnalyst()%>,
             customConfig,
             customFieldFormSchemas,
             details,
diff --git a/pipeline/src/org/labkey/pipeline/query/TriggerConfigurationsTable.java b/pipeline/src/org/labkey/pipeline/query/TriggerConfigurationsTable.java
index 1c33ffb0c81..0f4582cdb49 100644
--- a/pipeline/src/org/labkey/pipeline/query/TriggerConfigurationsTable.java
+++ b/pipeline/src/org/labkey/pipeline/query/TriggerConfigurationsTable.java
@@ -15,8 +15,12 @@
  */
 package org.labkey.pipeline.query;
 
+import org.apache.commons.lang3.StringUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.labkey.api.collections.CaseInsensitiveHashMap;
 import org.labkey.api.collections.NamedObjectList;
 import org.labkey.api.data.AbstractForeignKey;
 import org.labkey.api.data.AbstractTableInfo;
@@ -24,9 +28,12 @@
 import org.labkey.api.data.ColumnInfo;
 import org.labkey.api.data.Container;
 import org.labkey.api.data.ContainerFilter;
+import org.labkey.api.data.DbScope;
 import org.labkey.api.data.RenderContext;
 import org.labkey.api.data.TableInfo;
 import org.labkey.api.data.TableSelector;
+import org.labkey.api.dataiterator.DataIteratorBuilder;
+import org.labkey.api.dataiterator.DataIteratorContext;
 import org.labkey.api.pipeline.PipelineJobService;
 import org.labkey.api.pipeline.TaskPipeline;
 import org.labkey.api.pipeline.file.FileAnalysisTaskPipeline;
@@ -66,10 +73,15 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 
 public class TriggerConfigurationsTable extends SimpleUserSchema.SimpleTable<PipelineQuerySchema>
 {
+    private static final String CONFIGURATION = "Configuration";
+    private static final String CUSTOM_CONFIGURATION = "CustomConfiguration";
+    private static final String PARAMETER_FUNCTION = "parameterFunction";
+
     public TriggerConfigurationsTable(PipelineQuerySchema schema, ContainerFilter cf)
     {
         super(schema, PipelineSchema.getInstance().getTableInfoTriggerConfigurations(), cf);
@@ -250,21 +262,46 @@ public List<Map<String, Object>> insertRows(User user, Container container, List
             return ret;
         }
 
+        /**
+         * The data iterator skips insertRow()/updateRow(), so it would bypass validateConfiguration() and never start or stop listeners.
+         * Reports an error instead of throwing UnsupportedOperationException because the import action shows context errors
+         * to the user but lets runtime exceptions escape as a 500.
+         */
         @Override
-        public List<Map<String, Object>> updateRows(User user, Container container, List<Map<String, Object>> rows, List<Map<String, Object>> oldKeys, BatchValidationException errors, @Nullable Map<Enum, Object> configParameters, Map<String, Object> extraScriptContext) throws InvalidKeyException, QueryUpdateServiceException, SQLException
+        public int loadRows(User user, Container container, DataIteratorBuilder rows, @Nullable ArrayList<Map<String, Object>> outputRows, DataIteratorContext context, @Nullable Map<String, Object> extraScriptContext)
         {
-            List<Map<String, Object>> ret = new LinkedList<>();
-            for (Map<String, Object> row : rows)
+            context.getErrors().addRowError(new ValidationException("Bulk loading pipeline trigger configurations is not supported."));
+            return 0;
+        }
+
+        @Override
+        public List<Map<String, Object>> updateRows(User user, Container container, List<Map<String, Object>> rows, List<Map<String, Object>> oldKeys, BatchValidationException errors, @Nullable Map<Enum, Object> configParameters, Map<String, Object> extraScriptContext) throws InvalidKeyException, BatchValidationException, QueryUpdateServiceException, SQLException
+        {
+            if (oldKeys != null && rows.size() != oldKeys.size())
+                throw new IllegalArgumentException("rows and oldKeys are required to be the same length, but were " + rows.size() + " and " + oldKeys.size() + " in length, respectively");
+
+            List<Map<String, Object>> ret = new ArrayList<>(rows.size());
+            for (int i = 0; i < rows.size(); i++)
             {
+                Map<String, Object> row = rows.get(i);
                 try
                 {
-                    ret.add(updateRow(user, container, row, row, false, true));
+                    Map<String, Object> oldRow = getRow(user, container, oldKeys == null ? row : oldKeys.get(i));
+                    // getRow() selects by RowId alone, so the row may belong to another folder
+                    if (oldRow == null || !container.getId().equals(Objects.toString(oldRow.get("Container"), null)))
+                        throw new ValidationException("Pipeline trigger configuration not found in this folder.");
+
+                    ret.add(updateRow(user, container, row, oldRow, false, true));
                 }
                 catch (ValidationException e)
                 {
-                    ret.remove(row);
+                    errors.addRowError(e);
                 }
             }
+
+            if (errors.hasErrors())
+                throw errors;
+
             return ret;
         }
 
@@ -287,13 +324,85 @@ protected Map<String, Object> updateRow(User user, Container container, Map<Stri
 
             // call the stop() method for this config if it was successfully updated
             if (config != null)
-                config.stop();
+                afterCommit(config::stop);
 
             String newName = getStringFromRow(newRow, "Name");
             startIfEnabled(container, newName, newRow);
             return newRow;
         }
 
+        // Checked here rather than in insertRow()/updateRow() because alias keys (label, propertyURI) are resolved or dropped by now
+        @Override
+        protected Map<String, Object> _insert(User user, Container c, Map<String, Object> row) throws SQLException, ValidationException
+        {
+            validateConfiguration(user, null, row);
+            return super._insert(user, c, row);
+        }
+
+        @Override
+        protected Map<String, Object> _update(User user, Container c, Map<String, Object> row, Map<String, Object> oldRow, Object[] keys) throws SQLException, ValidationException
+        {
+            validateConfiguration(user, oldRow, row);
+            return super._update(user, c, row, oldRow, keys);
+        }
+
+        private void validateConfiguration(User user, @Nullable Map<String, Object> oldRow, Map<String, Object> newRow) throws ValidationException
+        {
+            Map<String, Object> row = new CaseInsensitiveHashMap<>(newRow);
+            parseJson(row, CUSTOM_CONFIGURATION);
+            if (oldRow != null && !row.containsKey(CONFIGURATION))
+                return;
+
+            JSONObject configuration = parseJson(row, CONFIGURATION);
+
+            // GH Issue 1524: the Parameter Function runs as server-side script, so only script authors may add, change, or clear it
+            if (user.isTrustedAnalyst())
+                return;
+
+            JSONObject oldConfiguration = null;
+            if (oldRow != null)
+            {
+                try
+                {
+                    oldConfiguration = parseJson(new CaseInsensitiveHashMap<>(oldRow), CONFIGURATION);
+                }
+                catch (ValidationException ignored)
+                {
+                    // A stored value that isn't valid JSON can't run, so it has no function to preserve
+                }
+            }
+
+            if (!Objects.equals(getParameterFunction(oldConfiguration), getParameterFunction(configuration)))
+                throw new ValidationException("You must be either a PlatformDeveloper or TrustedAnalyst to add, change, or remove a Parameter Function.");
+        }
+
+        /** Empty is allowed because FileWatcherPipelineTriggerConfig reads it as {}; anything else must parse there too */
+        private static @Nullable JSONObject parseJson(Map<String, Object> row, String column) throws ValidationException
+        {
+            Object value = row.get(column);
+            if (value == null || StringUtils.isEmpty(value.toString()))
+                return null;
+
+            try
+            {
+                return new JSONObject(value.toString());
+            }
+            catch (JSONException e)
+            {
+                throw new ValidationException("Invalid JSON for " + column + ": " + e.getMessage(), column);
+            }
+        }
+
+        /** Extracts the function as FileWatcherPipelineTriggerConfig does, where any non-null value runs via toString() */
+        private static @Nullable String getParameterFunction(@Nullable JSONObject configuration)
+        {
+            if (configuration == null)
+                return null;
+
+            String function = Objects.toString(configuration.toMap().get(PARAMETER_FUNCTION), null);
+            return StringUtils.isBlank(function) ? null : function;
+        }
+
         /** Implement to make sure the listener gets unregistered */
         @Override
         public int truncateRows(User user, Container container) throws QueryUpdateServiceException, SQLException
@@ -328,7 +437,7 @@ protected Map<String, Object> deleteRow(User user, Container container, Map<Stri
 
             // call the stop() method for this config if it was successfully deleted
             if (config != null)
-                config.stop();
+                afterCommit(config::stop);
 
             return deleteRow;
         }
@@ -336,15 +445,24 @@ protected Map<String, Object> deleteRow(User user, Container container, Map<Stri
         private void startIfEnabled(Container container, String name, Map<String, Object> row)
         {
             boolean enabled = Boolean.parseBoolean(row.getOrDefault("Enabled", false).toString());
-            PipelineTriggerConfig config = PipelineTriggerRegistry.get().getConfigByName(container, name);
 
-            if (config != null)
-            {
-                if (enabled)
-                    config.start();
-                else
-                    config.stop();
-            }
+            afterCommit(() -> {
+                PipelineTriggerConfig config = PipelineTriggerRegistry.get().getConfigByName(container, name);
+
+                if (config != null)
+                {
+                    if (enabled)
+                        config.start();
+                    else
+                        config.stop();
+                }
+            });
+        }
+
+        /** Listeners aren't transactional, so change them only once the caller's transaction commits (immediately if there is none) */
+        private void afterCommit(Runnable task)
+        {
+            getDbTable().getSchema().getScope().addCommitTask(task, DbScope.CommitTaskOption.POSTCOMMIT);
         }
 
         private String getStringFromRow(Map<String, Object> row, String key)