Organization-wide default access levels
Key Takeaway
Set each object's org-wide default to match the most restricted user, because sharing rules and the role hierarchy can only add access.
Organization-wide defaults (org-wide defaults, or OWDs) set the baseline access that users have to records they don't own. You set them separately for each object, and for internal and external users. Other sharing tools then open access back up for the people who need more.
How record access works in layers
Record access works in layers. Object permissions set what a user can do with an object at all. A user gets object permissions from their profile, permission sets, and permission set groups.
Org-wide defaults then narrow that access for records the user doesn't own. An org-wide default can never give more access than the object permission.
For example, imagine a user with Edit on contacts. If the Contact default is Private, that user still can't edit contacts they don't own.
There are four record-level controls. In order of increasing access, they are:
- Org-wide defaults
- Role hierarchies
- Sharing rules
- Manual sharing
The standard approach is to lock data down with the org-wide default, then use the other three controls to grant access to selected users.
Sharing rules and the role hierarchy can only add access, so they can't restrict access below what the org-wide default already gives. If any user must be blocked from seeing or editing some records, the default itself has to be restrictive.