Object, field, and record access layers
Key Takeaway
Object, field, and record access are separate layers. To see a field's value, a user needs the "Read" field permission. Removing a field from a page layout doesn't hide it in reports. Record access such as "View All Records" doesn't grant Read on a field.
Salesforce controls data access in layers. Object permissions decide whether a user can work with a type of record at all. Field permissions decide which fields on that object the user can see or edit. Record-level sharing decides which individual records the user can reach. Because the layers combine, you can give thousands of users the right access without setting permissions one user at a time.
The four levels of data access
Salesforce controls data access at four levels: organization, objects, fields, and records.
| Level | What it controls |
|---|---|
| Organization | The list of authorized users, password policies, and the hours and locations users can log in from |
| Object | Whether a user can create, read, edit, or delete records of an object type |
| Field | Whether a user can see and edit a specific field on an object |
| Record | Which individual records a user can view and edit |
The organization level decides who can log in. The object, field, and record layers then decide what each logged-in user can do with data. The security and sharing model works at the API level, so these permissions apply even when users query or update data through API calls.