Object permissions versus record-level sharing access
Key Takeaway
To work with a record, a user needs both the object permission and record-level access through sharing. The "View All Records", "Modify All Records", "View All Data", and "Modify All Data" permissions override sharing.
Salesforce controls data access in two separate layers. Object permissions decide what a user can do with a type of record, such as create, read, edit, or delete. Record-level sharing decides which individual records of that type the user can see or change. A user needs both layers to work with a record, so a gap in either one blocks access unless the user has a permission that overrides sharing.
Object permissions and sharing work together
Object permissions set the base-level access a user has to create, read, edit, and delete records for each object. A user's object permissions are the combined result of their profile, permission sets, and permission set groups. Salesforce recommends permission sets and permission set groups, because reusable building blocks avoid creating dozens of profiles for each job function.
The sharing model controls which records a user can see. Object permissions control what the user can do to those records. Think of the object permission as the key to the building and sharing as the keys to specific rooms. You need both to get in.
The "Read", "Create", "Edit", and "Delete" permissions all respect sharing, which means each one applies only to the records that sharing gives the user access to.
| Permission | What users can do |
|---|---|
| Read | View records only |
| Create | Read and create records |
| Edit | Read and update records |
| Delete | Read, edit, and delete records |