Territory-based account access versus role hierarchy and sharing rules
Key Takeaway
Territory account alignment doesn't inherit between parent and child territories, unlike the role hierarchy. Align the account directly to the user's own territory. Then run the Align Account to Territory job so the account appears in the mobile app.
Salesforce gives users access to records they don't own through layered sharing features. Organization-wide defaults set the baseline. The role hierarchy passes access up to users above the record owner, and sharing rules create exceptions for groups and roles. Agentforce Life Sciences for Customer Engagement ties provider account visibility to territories, so a field user sees and manages the accounts aligned to the territories they are assigned to. Territory access doesn't follow the role hierarchy, so you need to know how territories grant access to explain why a user does or doesn't see an account.
Sharing features that extend record access
Organization-wide defaults set the baseline access for each object, such as Private. The role hierarchy, sharing rules, and manual sharing then extend access to records a user doesn't own.
- The role hierarchy automatically grants users access to records owned by or shared with their subordinates. A user's access follows their position in the hierarchy.
- Sharing rules are exceptions to organization-wide defaults of Private or Public Read Only. They are based on record owner or field values. They extend access to public groups and roles regardless of where users sit in the role hierarchy.
- Manual sharing covers one-off cases where no consistent group of users can be defined. The record owner shares the record by hand. Unlike the other features, manual sharing isn't automated.
Restriction rules work in the opposite direction from sharing rules. Instead of extending access, they narrow the records a user can read through sharing settings to those that match set criteria. They work like a permanent list view filter.