Record Access (Sharing)

Requirement

My client has multiple Business Units and all BUs need Read Only access to ALL accounts but these BUs are competitive in nature and they should not be able to view each other activities. I understand if they have access to account they can see all activities but I want to restrict the visibility of all activites tasks, events and emails based on the BUs.

I can only create 2 restriction rules per object, therefore, can't use all the BUs to restrict activities. Also can I restrict visibility of emails using restrictions rules?

What other solutions I can provide my client to meet this requirement?

I belong to a Business Unit that needs to restrict User access to specific Opportunities within shared Accounts, e.g. Account X has many Opportunities and some of them should only be viewed or accessed by certain Users.  Is this possible and what would be the best/simplest way forward?  Could the sensitive Opportunities be tagged with a custom field and then Restriction Rules be established to limit which Users can view/edit said Opportunities?  If so, any advice on how a relatively naïve user could start this process (there are literally hundreds of Restriction Rule videos out there and advice on filtering them would be appreciated)?  If Restriction Rules is not the way to go, any advice on how to proceed?

Thanks in advance!

Hello Trailblazers!  As we go GA in Winter ‘22, we want to hear your feedback. 

Standard objects may have unique behaviors that we need to ensure are working with Restriction Rules. I have created a set of ideas based on feedback shared in the trailblazer community for standard objects; this way, the object owners can see and respond to your feedback.  Please follow these links to upvote and and comment.

• Account
• Contact
• Case
• Opportunity
• Product2
• Asset
• EmailMessage
• Lead
• External Objects (those using OData 2 & 4 is available since Summer '22)

 We are also interested in what areas you’d like to see additional investment in and what use cases this will unlock for you. Where should we invest in Restriction Rules such that the user or record criteria supports:

• AND operator
• OR operator
• IN operator (do you usually think of this as CONTAINs?)
• cross object lookup aka spanning fields (today we support a single level for record criteria)
• picklists (delivered as part of Spring '22 & Summer '22)
• formula (thank you Benjamin Bratcher for creating this idea)

========

(original post tweaked) On Sept 10, from 11:15am -12:30pm PDT, we'll be answering your questions live during the Winter '22 RRL Admin Preview!  We’ll cover the latest enhancements for Flow, Dynamic Interactions, Security Center, restriction rules, + more!  Register here #AwesomeAdmins #AwesomeAdmins #AwesomeAdmins #AwesomeAdmins#AwesomeAdmins → https://sforce.co/2Vokqte

https://www.salesforce.com/form/event/release-readiness-winter-22/

Hi folks!

Did you catch @Cheryl Feldman talking about The Future of User Access at TDX ’24? Were you inspired by @Jamin Hall sharing how Einstein Copilot saves you time troubleshooting (see timestamp 27:35-28:37)?

Help us help you, by telling us how you would interact with Einstein Copilot in this survey.

Thank you,

Larry Tung

@The Future of User Management

#Salesforce Admin@Admin Trailblazers @Record Access (Sharing) @Tuhina Koppikar @Sanghoon Oh

For use in an experience cloud site, I want users to be able to submit leads and track them as they go through the internal sales process.

Could you share your thoughts on Modify ALL Data, View All Data (MAD/VAD) versus Modify All (Records), View All (Records) on individual objects?

Restriction Rules currently are bypassed if a user has:

• MAD/VAD

I'd like to make a product change (in Summer '22) to also bypass Restriction Rules if a user has 

• MAR/VAR (since the permission for that object says "Modify All" or "View All."

I understand that some customers might have granted a user VAR or MAR and then used Restriction Rules to filter access. Although this currently works, it does sound a bit counter-intuitive. If you're a customer who currently does this or has strong feedback on why we shouldn't make MAR/VAR like MAD/VAD, please comment in this post. Thank you.

Cc:

@Dan Sheehan (He/Him)

Salesforce Record Access Resolutions for 2024 (12 min video)

• Are you ... doing your annual realignment?
• Making big changes to your role hierarchy?
• Making a large number of public group membership or territories?

If you large record volumes, check it out!

And if you have feedback on how long it takes regarding sharing/record access related changes, please let me know!

@Record Access (Sharing) @Record Access (Sharing) Pilots & Betas @Admin Trailblazers

Hi, all,

I am learning sharing and visibility, especially Account Team.

A help regarding Account Access via Team, it states, "Suppose that a user with group-based access adds account team members. If the account owner is changed, the team members added by users with group-based access are removed from the team, even if the Keep account team option is selected."

https://help.salesforce.com/s/articleView?id=sf.accountteam_def.htm&type=5

I cannot understand "Suppose that a user with group-based access adds account team members." What is "a user with group-based access"? Can anyone understand this?

Hi, all,

I am learning Sharing on this document.

https://developer.salesforce.com/docs/atlas.en-us.246.0.dat.meta/dat/dat_components.htm

In this document, regarding Public Groups Use Cases, it describes 'Groups also have the ability to protect data shared in the group from being made accessible to people in the role hierarchy above the group members. This (and dealing with the access of record owners and their management hierarchy) allows the creation of groups in which very highly confidential information can be shared—the data will be accessible ONLY to group members, and nobody else in the organization. This is accomplished by using the Grant Access Using Hierarchies setting.'

But I cannot imagine how this can be realized by using the Grant Access Using Hierarchies setting? Can anyone come up with any ideas to realize this? (My understanding is that when we use Grant Access Using Hierarchies setting, users in upper roles can see the records which are defined to be shared by only a specific Public Group by Sharing Rule.)