Free Sample Lesson: Record access: org-wide defaults, roles, sharing rules and restriction rules (Platform Administrator II Cert Lab)

Free sample lesson from the Platform Administrator II Cert Lab. The full course has 18 lessons and 4 full practice exams.

Unlock every section

Security and Access · SA1 · part of the 20% section · about 20 min with practice

SA1: Record access: org-wide defaults, roles, sharing rules and restriction rules

You’ll be able to: pick the record-access feature that opens or narrows access for a given scenario.

Which record-access tool when

You need to…	Use	Remember
Set the baseline for records a user doesn’t own	Org-wide defaults (OWD)	Private, Public Read Only or Public Read/Write for most objects; internal and external defaults are separate
Let managers see their team’s records	Role hierarchy	Users see records owned by or shared with users below them
Open records to a group, role or territory automatically	Sharing rule (owner- or criteria-based)	Never stricter than the OWD; up to 300 per object, 50 criteria-based
See a parent account because you own its case or contact	Implicit sharing	Read Only on the parent; standard relationships only
Show some users only a subset of records they could otherwise see	Restriction rule	Filters access; custom objects, external objects, quotes, contracts, events, tasks and a few more
Stop managers seeing a custom object’s records	Clear Grant Access Using Hierarchies	Only available for custom objects

Start with the most restrictive baseline

Org-wide defaults set the access users have to records they don’t own. Set them to the most restrictive level any user needs, then open access with the role hierarchy, sharing rules, teams and manual sharing. Every one of those tools can only grant more access. None of them can take access away below the OWD.

Sharing rules extend access to users in public groups, roles or territories. An owner-based rule shares records owned by one set of users; a criteria-based rule shares records whose field values match. An object can have up to 300 sharing rules, including up to 50 criteria-based or guest user rules. To change who gets access on an existing rule, delete it and create a new one; you can edit only the label, name, access level and a few type-specific settings.

Exam trap

If a scenario says some users must see fewer records than the OWD and sharing give them, the answer isn’t a sharing rule. It’s a restriction rule (or a stricter OWD with sharing to open it back up).

Restriction rules narrow access

A restriction rule filters the records a user already has access to, so they see only records matching your criteria. It applies across list views, lookups, related lists, reports, search, SOQL and SOSL. Restriction rules work on custom objects, external objects, quotes, contracts, events, tasks, time sheets and time sheet entries. You get up to two active rules per object in Enterprise and Developer editions and up to five in Performance and Unlimited.

Implicit sharing and the hierarchy

Implicit sharing is built in. If you can access an account’s child case, contact or opportunity, you get Read Only access to the parent account, even with the Account OWD set to Private. That doesn’t apply when your only access to the child comes from View All Records or Modify All Records. Implicit sharing covers standard relationships only.

For custom objects, you can turn off Grant Access Using Hierarchies on the Sharing Settings page so that only owners and users granted access see the records. Queues have their own Grant Access Using Hierarchies setting, which shares queue records with members’ superiors in the role hierarchy.

Predict, then reveal

Support agents must see only cases they work on, but the Case OWD is Public Read Only. Can a sharing rule fix it?

Show the answer

No. Sharing rules only add access. Make the Case OWD Private, then open access with the role hierarchy, queues, teams or sharing rules where needed.

Report and dashboard folders

Folder access has three levels. Viewer lets you view the reports or dashboards. Editor lets you view and save them. Manager also lets you share, rename and delete. A new folder is visible only to you and admins until you share it. When you share a folder with a role, only users in that role see it, not superior roles.

Try it 5 min · your free Developer Edition org or Trailhead Playground

From Setup, open Sharing Settings and note the default internal and external access for Account and one custom object.
Create a public group, then a criteria-based sharing rule on a custom object that shares records with a status of Urgent with that group as Read Only.
Open Restriction Rules on a custom object (or Task) and look at the user and record criteria fields. Don’t activate a rule in a production org.