Restriction rules for narrowing record visibility
Key Takeaway
A restriction rule never grants access. It permanently filters the records a user can already see on one object down to only the records that match the rule.
Restriction rules narrow which records certain users can see. They work as a permanent filter on top of the access users already get from org-wide defaults, sharing rules, Enterprise Territory Management and other sharing mechanisms. They exist because some records, like tasks, events and contracts, are hard to make truly private with org-wide defaults alone.
What a restriction rule does
A restriction rule filters access and never grants it. When a rule applies to a user, Salesforce starts from the records that user can already read through org-wide defaults, sharing rules and other sharing mechanisms. The rule then cuts that set down to only the records that match the rule.
The effect is like a filter on a list view or report, except that a restriction rule is permanent.
Use a restriction rule when certain users should see only a specific set of records. For example, two competing sales teams work on the same account but must not see each other's activities. A restriction rule can make each team see only its own tasks and events.
Lena works in the Legal department. Through org-wide defaults and sharing rules, she can read 200 contracts. An admin adds a restriction rule on contracts that applies to users in the Legal department and lets them see only contracts with the Legal Review record type. 60 of Lena's 200 contracts have that record type, so she now sees those 60 in list views, reports and search. One Legal Review contract was never shared with Lena, and it stays hidden from her, because the rule only removes access and never adds it.