Data Sharing

💬 In plain words: Everything else in sharing only ADDS access. Restriction Rules are the one tool that SUBTRACTS. They filter which records a user can see even if sharing granted them. Scoping rules just change the default view, not real access. Implicit sharing is built-in glue (see the Account, see its child Cases). 📌 Example: Contractors log time in Tasks, but must not see employees' tasks. OWD change would hurt everyone — instead, place one Restriction Rule on the contractor permission set: 'you see only Tasks where OwnerId = you' . Everyone else remains unchanged. 🎬 Real-Life Example: The Contractor Who Saw Too Much Hub contractors log in to update deliveries for their own hub. But role hierarchy and sharing rules keep granting them a wider view — other hubs, other cities. The Old/Bad Way: Try to fix it with more sharing configuration. Hours of tweaking, no result. Because sharing can only ADD access. Noth...

💬 In plain words: Sharing rules are standing "open the door" instructions: owner-based ( 'records owned by Team A → visible to Team B' ) or criteria-based ( 'all records where Region = North → visible to North group' ). They only widen access, never narrow it. 📌 Example: 'Records owned by Delhi Sales team → share read-only with Delhi Support team' = owner-based rule. 'All Accounts where Region = North → visible to North group' = criteria-based. Both only ADD access. Concept Sharing rules open access sideways, where the role hierarchy cannot reach. An owner-based rule shares records owned by one group or role with another group or role. A criteria-based rule shares records that match specific field values, no matter who owns them. Three core constraints: They can only widen access, never restrict it (restriction is handled by Restriction Rules). They share to public groups, role...