Org-wide defaults as the baseline for patient and member records
Key Takeaway
Set each object's org-wide default to match its most restricted user, because other sharing tools can only add access on top of it.
Organization-wide defaults (org-wide defaults, or OWDs) set the baseline access users have to records they don't own, object by object. In an Agentforce Health org, you use them to lock records down to what the most restricted user should see. You then open access back up for the people who need it with other sharing tools.
Four layers of record access
Record-level access comes in four layers. In order of increasing access, the layers are:
- Org-wide defaults
- Role hierarchies
- Sharing rules
- Manual sharing
You lock data down with org-wide defaults. You then use the other three layers to grant access to selected users.
Role hierarchies, sharing rules and other record access features can only grant extra access, so they can't restrict access below the org-wide default. If any user must be kept out of some records, the default itself has to be restrictive enough.