Sharing tools as additive exceptions versus restriction rules
Key Takeaway
Most sharing tools can only grant more access, while restriction rules narrow the records a user can already see.
Record access in Salesforce starts from a baseline set by organization-wide defaults (OWD). Most sharing tools, such as the role hierarchy and sharing rules, can only open access up from that baseline. Restriction rules work the other way: they narrow the records a user can already see down to a set that matches criteria you choose.
Organization-wide defaults set the baseline
Record access is built in layers. Organization-wide defaults (OWD) are the baseline: they set the default access users have to each other's records for each object.
You set OWD to the most restrictive level any user needs. Then you use the other sharing tools to give more access to the users who need it.
The OWD settings are:
- Private: only the record owner and users above the owner's role in the hierarchy can view, edit and report on records.
- Public Read Only: everyone can view and report on records, but only the record owner and users above the owner can edit.
- Public Read/Write
- Controlled by Parent