Field-level security on profiles and permission sets
Key Takeaway
Profiles, permission sets, and permission set groups can grant field access but cannot deny it. When a page layout and field-level security both apply, the most restrictive setting always wins.
Field-level security, also called field permissions, controls whether a user can read or edit each field on an object. Users often need an object but not every field on it. For example, salary fields might be meant only for a payroll manager. You set field-level security on profiles and permission sets.
The three access levels
Field-level security has three access levels for each field. The labels for these levels depend on where you set them.
| What the user can do | Permission sets and the enhanced profile user interface | The original profile user interface and the field-level security pages for customizing fields |
|---|---|---|
| Read and edit the field | Read and Edit | Visible |
| Read the field but not edit it | Read | Visible and Read-Only |
| Neither read nor edit the field | None | None |