Restriction Rules

💬 In plain words: Everything else in sharing only ADDS access. Restriction Rules are the one tool that SUBTRACTS. They filter which records a user can see even if sharing granted them. Scoping rules just change the default view, not real access. Implicit sharing is built-in glue (see the Account, see its child Cases). 📌 Example: Contractors log time in Tasks, but must not see employees' tasks. OWD change would hurt everyone — instead, place one Restriction Rule on the contractor permission set: 'you see only Tasks where OwnerId = you' . Everyone else remains unchanged. 🎬 Real-Life Example: The Contractor Who Saw Too Much Hub contractors log in to update deliveries for their own hub. But role hierarchy and sharing rules keep granting them a wider view — other hubs, other cities. The Old/Bad Way: Try to fix it with more sharing configuration. Hours of tweaking, no result. Because sharing can only ADD access. Noth...

⚡ 1-Minute Summary Sharing only ever ADDS access. Restriction rules are the one tool that subtracts. Set the org-wide default to the most closed honest answer. Then open up on purpose. Sharing decides WHICH ROWS . CRUD and FLS decide which objects and fields. Never mix them up. Module map MODULE 3 root: 'Who can see which ROWS?' ├─ OWD (baseline) + Hierarchy (vertical) ├─ Sharing Rules (lateral) + Manual/Apex share (per-record) ├─ Restriction Rules (the ONLY subtraction) ├─ View/Modify All (OBJECT perm — OVERRIDES sharing) └─ with/without/inherited sharing (Apex enforcement) OWD & Role Hierarchy 💬 In plain words: Org-Wide Defaults (OWD) is the default lock on every record — start with the tightest setting the business allows. The role hierarchy then opens records UPWARD: managers see what their team sees. Everything else (sharing rules, manual shares) only ADDS access; nothing below OWD can remo...