Organization-wide defaults versus role hierarchy access
Key Takeaway
Organization-wide defaults set the baseline access users have to records they don't own. The role hierarchy can only add to that baseline, by giving users in higher roles the same access as the users below them. To stop that upward access for one custom object, deselect "Grant Access Using Hierarchies" for that object.
Organization-wide defaults (org-wide defaults for short) set the baseline access users have to records they don't own, object by object. The role hierarchy then opens that access upward, so users in higher roles automatically get the same access as the users below them. Together they form the first two layers of record-level security. You lock data down with org-wide defaults, then open it back up vertically with roles.
Record-level security is built in layers
Record-level security works in layers. In order of increasing access, the four main controls are:
- Org-wide defaults
- The role hierarchy
- Sharing rules
- Manual sharing
The usual approach is to set org-wide defaults to the most restrictive level needed. You then use the other controls to open access to the users who need it.
No sharing feature can take away access that the org-wide default gives, because the role hierarchy, sharing rules, and manual sharing can only grant more access. So if some users must not see or edit certain records, the org-wide default for that object must be restrictive enough.