Record-level sharing baseline and mechanisms for client data
Key Takeaway
Set each organization-wide default to the most restrictive level the business needs, then add access on top. Owner-based sharing rules open a whole group of owners' records automatically, including new ones. Compliant Data Sharing participant roles grant per-record access whose level you change in one place.
Record-level sharing decides which individual client records, such as accounts, opportunities and financial deals, a user can see or edit. You set a locked-down baseline with organization-wide defaults. You then open access to selected users with tools like the role hierarchy, sharing rules, teams and manual sharing. Agentforce Financial Services adds Compliant Data Sharing, which ties each user's access on a record to a participant role.
Organization-wide defaults set the baseline
Record-level sharing works in layers. You set each OWD to the most restrictive level the business needs. You then open access to selected users with the role hierarchy, sharing rules, teams, manual sharing, Apex managed sharing and Compliant Data Sharing.
Sharing can only add access. When an OWD is Private or Public Read Only, other record access features can grant more access. None of them can restrict access below what the OWD allows.
Most objects support the OWD levels Controlled by Parent, Private, Public Read Only and Public Read/Write. You can set separate defaults for internal users and external authenticated users. For example, you can set external access to accounts to Private and then open access for certain partner users with sharing rules.
Sharing controls which records a user can see, but object permissions in profiles and permission sets control what the user can do with them. A user you share an account with still needs the "Read" permission on accounts to see it. A user with the "Edit" permission on contacts still can't edit contacts they don't own when the contact OWD is Private.