OWD

In the Salesforce security architecture, object-level permissions sit directly at the top of the data access pyramid. Understanding how permissions like View All and Modify All bypass standard record-level sharing models is essential for passing CTA scenarios and maintaining enterprise data governance.

💬 In plain words: Record access in Salesforce is calculated through specific grant types stored inside share tables. These fall into four distinct categories: explicit grants (rules, manual shares, Apex), implicit grants (parent-child relationship linkages), inherited grants (role hierarchy rollups), and group-membership grants (public groups and queues). Understanding these grant types makes access calculations clear and simplifies debugging. 📌 Example: If a user can view a parent Account without owning it or receiving a manual share, check related records. If they own an open Case under that Account, Salesforce automatically grants implicit read access to the parent record. 🎬 Real-Life Example: Auditing Unexpected Record Access A manager asks why a team member can view a confidential Delivery__c record that was never explicitly shared with them. The Wrong Way: Checking user profiles and permission sets for hours. Profiles and permis...

⚡ 1-Minute Summary Sharing only ever ADDS access. Restriction rules are the one tool that subtracts. Set the org-wide default to the most closed honest answer. Then open up on purpose. Sharing decides WHICH ROWS . CRUD and FLS decide which objects and fields. Never mix them up. Module map MODULE 3 root: 'Who can see which ROWS?' ├─ OWD (baseline) + Hierarchy (vertical) ├─ Sharing Rules (lateral) + Manual/Apex share (per-record) ├─ Restriction Rules (the ONLY subtraction) ├─ View/Modify All (OBJECT perm — OVERRIDES sharing) └─ with/without/inherited sharing (Apex enforcement) OWD & Role Hierarchy 💬 In plain words: Org-Wide Defaults (OWD) is the default lock on every record — start with the tightest setting the business allows. The role hierarchy then opens records UPWARD: managers see what their team sees. Everything else (sharing rules, manual shares) only ADDS access; nothing below OWD can remo...