register_meta with show_in_rest, and the meta box you can stop writing

A meta field that is registered, typed and exposed to the API can be edited from the editor sidebar with no PHP form, no nonce and no save handler.

register_post_meta( 'case_study', 'client_sector', array(
    'type'              => 'string',
    'single'            => true,
    'show_in_rest'      => true,
    'sanitize_callback' => 'sanitize_text_field',
    'auth_callback'     => function () {
        return current_user_can( 'edit_posts' );
    },
) );

The auth_callback is the part that must not be skipped — the default allows anyone who can edit the post to write the field, which is usually right and is a decision worth making explicitly for anything sensitive. Only single meta of a scalar type is exposed cleanly this year; arrays and objects need a schema and are fiddly. Registering meta properly also makes it visible to WP_Query validation and to anything else that reads the registry, which is worth the six lines regardless of the editor.