Troubleshooting unexpected access from security settings
Key Takeaway
To find where an unwanted permission comes from, open "View Summary" on the user's detail page. Click the permission's row-level action, then click "Access Granted By". Fix the access at the profile, permission set or permission set group it shows.
When a user can see or do something they shouldn't, an admin traces that access back to the setting that grants it. The admin then removes the access at that setting. Salesforce splits this troubleshooting into four kinds of issues: object and record access, field access, feature access, and access for external users in an Experience Cloud site. Each kind has its own set of permission and sharing checks.
Gather the facts first
Start by gathering facts. Find the objects, records, fields or features involved. Then find the user's profile, permission sets and role. For a record access issue, also find the record owner's role.
Check object permissions before you check sharing. If the user's object permissions are correct, the issue is record access, not object permissions.