Product default external access in organization-wide defaults
Key Takeaway
Salesforce recommends setting "Default External Access" for product records to Private in every B2B Commerce use case, including orgs with multiple stores. Private keeps authenticated buyers from using SOQL queries to find products they aren't entitled to.
Organization-wide defaults set the default level of record access. Default External Access sets that level separately for external authenticated users, such as Experience Cloud site users. Buyers who sign in to a store count as external authenticated users. In B2B Commerce, product records should have a Default External Access of Private in every use case. If they don't, buyers who sign in to an org with multiple stores or other Experience Cloud sites can find products they aren't entitled to.
What Default External Access controls
Default External Access lets you give external authenticated users a different default access level than internal users. You can keep external users more restricted at first and then open up access for them with other features.
An object's external access level can't be more permissive than its internal access level. External access can match internal access or be stricter, but never looser.
Your sales team needs to see every account, so internal users get Public Read Only access to accounts. Your partner users shouldn't start with that much access, so Default External Access for accounts stays Private. Later, when a partner needs to work with certain accounts, you open up record access for external users with other features.
Separate external defaults simplify sharing rule setup and improve recalculation performance. Reports, list views, searches and API queries also run faster with separate external defaults.