Object, field and record-level access layers for client data
Key Takeaway
Salesforce decides what client data a user can reach in four stacked layers: organization, object, field, and record. Lock client records down with a restrictive org-wide default, open access only as far as each user needs, and hide sensitive fields with field-level security.
Salesforce controls access to client data at four levels: organization, object, field, and record. A design for a bank or wealth firm must get all four right together, because each level narrows or opens access on top of the one before it. Agentforce Financial Services adds Compliant Data Sharing on top of the standard record-level tools for regulated, need-to-know sharing.
The four access layers
The organization level decides who can log in at all. The other three levels decide what a logged-in user can do with client data.
| Layer | What it decides | Controlled through |
|---|---|---|
| Organization | Who can log in at all | Authorized users, password policies, login hours and locations |
| Object | Which kinds of records a user can work with, such as Account or Opportunity | Profiles, permission sets, permission set groups |
| Field | Which details on those records a user can see or edit | Profiles, permission sets, permission set groups |
| Record | Which individual records of an object a user can see | Org-wide defaults, role hierarchy, sharing rules, manual sharing, Compliant Data Sharing |
Roles and permission sets are easy to confuse, but they control different things. Permission sets and profiles control object and field access. Roles mainly control record access through the role hierarchy and sharing rules.
The layers stack. A user who has access to an account field also has access to the Account object, but sharing can still hide a specific account record from that user.