Field-level security versus page layouts
Key Takeaway
Use field-level security to secure a field everywhere it can appear, and use page layouts to organize detail and edit pages. When the two disagree, the most restrictive setting applies.
Field-level security, also called field permissions, decides whether a user can see or edit a specific field anywhere in Salesforce. Page layouts decide how fields, buttons, and related lists are arranged on a record's detail and edit pages. The two work together, but they do different jobs.
What field-level security controls
Field-level security is the second layer of data access after object permissions. A user can have access to an object and still be blocked from a sensitive field on it, such as a candidate's social security number. You don't need to hide the whole object to block that field.
Field-level security sets one of three access levels for each field. The labels for those levels differ by screen.
| Access level | Permission sets and the enhanced profile user interface | Original profile user interface and field-level security pages |
|---|---|---|
| Users can read and edit the field | Read and Edit | Visible |
| Users can read the field only | Read | Visible and Read-Only |
| Users can neither read nor edit the field | None | Neither option selected |
You grant field-level security through profiles and permission sets. Salesforce recommends permission sets and permission set groups because you can reuse them instead of building many profiles. Some field permissions are always enabled, and you can't modify them in permission sets or profiles.
Field-level security applies everywhere a field can appear:
- Detail and edit pages
- Related lists
- List views
- Reports
- Search results
- Email and mail merge templates
- Custom links
- Connect Offline
- Experience Cloud sites and portals
- Imported and synchronized data
- Salesforce APIs