Declarative sharing tools versus Apex managed sharing
Key Takeaway
If the people who get access depend on the record's data, you need Apex managed sharing, which developers write in code. Sharing rules can't pick a user from each record.
Salesforce uses a set of sharing tools to decide who can see records they don't own. Declarative tools, which you configure without code, meet most needs. Apex managed sharing is the code-based option that developers use when those tools can't express the access the business needs.
The five types of record-level security
Record-level security, also called the sharing model, controls access to records a user doesn't own. It has five types:
- Organization-wide defaults (OWD)
- Role hierarchy
- Sharing rules
- Manual sharing
- Apex managed sharing
The first four are declarative: an app builder can configure them without code. Apex managed sharing is a boundary between declarative and programmatic work, because it requires the development team to write code.