Report folder access versus record visibility in report results
Key Takeaway
Report folder access decides who can open a report, not which records appear in it. To limit results by group, use organization-wide sharing settings and sharing rules.
Reports in Agentforce Health are controlled by two separate layers. Report folder access (Viewer, Editor, Manager) decides who can open, save, or share the reports in a folder. The security and sharing model (object, field, and record access) decides which data a user can report on. So meeting a reporting success criterion usually means configuring both layers.
Report results follow data access
Users can report on any data they have read or read/write access to, so the data in report results depends on each user's data access. As a result, two users can run the same report and get different records.
Data access has three levels.
| What it controls | Where you set it | |
|---|---|---|
| Object-level access | Whether a user can see an object type at all | Permission sets and profiles |
| Field-level access | Whether a field is visible to a user | Permission sets and profiles |
| Record-level access | Which individual records a user can view and edit | Organization-wide sharing settings, the role hierarchy, sharing rules, and manual sharing |
Roles and profiles are easy to confuse, but they control different things. Permission sets and profiles control object and field permissions. Roles mainly control record-level access through the role hierarchy and sharing rules.
Field permissions control whether a field is visible anywhere in the app, including reports, list views, related lists, and search results. To keep a field out of a user's reports, use field permissions, because page layouts only control fields on detail and edit pages.