Configure versus Use Compliant Data Sharing permissions
Key Takeaway
Give "Configure Compliant Data Sharing" to the people who set up the feature and manage participant roles and participant groups. Give "Use Compliant Data Sharing" to every user who shares records or has records shared with them, and put it in a separate permission set.
Compliant Data Sharing lets Agentforce Financial Services admins and compliance managers set advanced sharing rules without writing complex code. With those rules, they control and monitor what data is shared with whom. Access to the feature is split into two system permissions. Configure Compliant Data Sharing is for the people who set the feature up. Use Compliant Data Sharing is for the people who share records or have records shared with them. Neither permission does anything until the object itself is ready for Compliant Data Sharing.
How Compliant Data Sharing grants access
Compliant Data Sharing grants record access to participants beyond the org-wide sharing defaults. Before the permissions do anything on an object, the object needs an org-wide sharing default of Private or Public Read-Only. The object must also be turned on in "Object Enablement Settings". Until both are true, granting the permissions changes nothing on that object.
If the object's org-wide sharing default is Public Read/Write...
Change the default to Private or Public Read-Only before you set up Compliant Data Sharing. At Public Read/Write, everyone in the org can already access the object's records, so Compliant Data Sharing has no effect on a participant's access.
If the object's org-wide sharing default is already Private or Public Read-Only...
The default needs no change, so you can go on to turn the object on in Object Enablement Settings.