Object and field permissions versus record-level sharing
Key Takeaway
Object permissions set the ceiling, and record-level sharing decides which records fall under it, so org-wide defaults can never give a user more access than their object permissions allow.
Salesforce controls data access in layers. Object and field permissions decide what kinds of data a user can work with at all. Record-level sharing then decides which individual records of that object the user can see and edit, so a user needs both layers to reach a record.
Two layers of data access
Object and field permissions form the first layer. Record-level sharing (or simply sharing) forms the second.
| What it decides | Where you set it | |
|---|---|---|
| Object permissions | Whether a user can create, read, edit, or delete records of an object type, such as leads or opportunities | Profiles, permission sets, and permission set groups |
| Field permissions (field-level security) | Whether a user can read or edit the value of a particular field | Profiles, permission sets, and permission set groups |
| Record-level sharing | Which individual records of that object the user can see and edit | Org-wide defaults, the role hierarchy, sharing rules, and manual sharing |