Record access and the sharing model

Object permissions say what a user can do with a type of record; sharing says which individual records they can reach. Start from the most restrictive baseline the business needs (organization-wide defaults), then open access with the role hierarchy, sharing rules, teams, and manual sharing. Field-level security hides individual fields.

Layers of access

• Object permissions: Create, Read, Edit, Delete, View All, and Modify All per object, from profiles and permission sets. Without Read on the object, sharing doesn't matter.
• Record access: Which specific records a user can see or edit. Controlled by ownership, organization-wide defaults, the role hierarchy, and sharing.
• Field-level security (FLS): Visible and Read-Only settings per field, per profile or permission set. FLS applies everywhere: page layouts, reports, list views, search, and the API.
• A user needs all three: permission on the object, access to the record, and access to the field.

Organization-wide defaults

• Purpose: The baseline access users have to records they don't own. Set it to the most restrictive level any user needs, then open up.
• Settings: Private, Public Read Only, and Public Read/Write. Leads and cases also offer Public Read/Write/Transfer. Detail objects in a master-detail relationship use Controlled by Parent.
• Grant Access Using Hierarchies: Lets managers see their team's records through the role hierarchy. It's always on for standard objects and can be turned off for custom objects.
• External defaults: A separate default for external users such as portal or community users, which can be the same as or more restrictive than the internal default.

Opening up access

• Role hierarchy: Users higher in the hierarchy get the same access as the users below them. It is about data visibility, not an org chart, and it is separate from profiles.
• Owner-based sharing rules: Share records owned by members of one group, role, or territory with another group, role, or territory.
• Criteria-based sharing rules: Share records that match field values, such as every account where Region equals EMEA, whoever owns them.
• Public groups: Named collections of users, roles, and other groups, used as the target of sharing rules, list view visibility, and folder sharing.
• Manual sharing: The record owner (or someone above them, or an admin) shares one record with a user or group. Use it for exceptions, not as a model.
• Teams: Account teams, opportunity teams, and case teams give named people a role and an access level on a record, such as a solutions engineer on an opportunity.

Restricting access

• Sharing rules, the role hierarchy, and manual sharing only ever widen access. To take access away, make the organization-wide default more restrictive.
• Restriction rules: Narrow which records a user can see even when other settings would show them, for example contractors seeing only active records. Available for selected objects.
• View All and Modify All: Object permissions that ignore sharing for that object. Keep them for admins and integration users. View All Data and Modify All Data do the same across every object.