Field-level security versus page layouts for sensitive HCP data
Key Takeaway
Restrict sensitive HCP fields with field-level security, not page layouts. A field removed only from a page layout is hidden on that page but can still appear in Salesforce reports.
Salesforce has two separate tools that affect which fields a user sees: field-level security (FLS) and page layouts. From the user's side, both can keep a field off a detail page. But only FLS controls whether the user can access the field, so the choice matters for sensitive data such as HCP data in Agentforce Life Sciences.
What each tool controls
Field-level security controls whether a user can access a field at all. A page layout only controls how fields are arranged on detail and edit pages.
When a page layout and FLS disagree, FLS wins. For example, if a field is required on the page layout but read-only in FLS, the field is read-only for the user.