Sharing Rules

💬 In plain words: These three keywords tell Apex whose eyes to use. with sharing respects the running user's record access. without sharing acts like God mode to see everything. inherited sharing copies whatever the caller was using. Default habit: use with sharing , and go without only on purpose. 📌 Example: An invoice service class marked with sharing returns only invoices Asha can see. A nightly stats job marked without sharing counts ALL invoices on purpose (and documented). A shared utility class marked inherited sharing behaves like whoever called it. 🎬 Real-Life Example: The Component That Leaked Other Drivers' Parcels A "My Deliveries" Lightning Web Component (LWC) goes live. A driver scrolls past his own list—and keeps scrolling into everyone else's deliveries. The Old/Bad Way: The Apex controller class had no sharing keyword. Depending on how it was entered, it ran in system context, ignori...

💬 In plain words: Sharing rules are standing "open the door" instructions: owner-based ( 'records owned by Team A → visible to Team B' ) or criteria-based ( 'all records where Region = North → visible to North group' ). They only widen access, never narrow it. 📌 Example: 'Records owned by Delhi Sales team → share read-only with Delhi Support team' = owner-based rule. 'All Accounts where Region = North → visible to North group' = criteria-based. Both only ADD access. Concept Sharing rules open access sideways, where the role hierarchy cannot reach. An owner-based rule shares records owned by one group or role with another group or role. A criteria-based rule shares records that match specific field values, no matter who owns them. Three core constraints: They can only widen access, never restrict it (restriction is handled by Restriction Rules). They share to public groups, role...

⚡ 1-Minute Summary Sharing only ever ADDS access. Restriction rules are the one tool that subtracts. Set the org-wide default to the most closed honest answer. Then open up on purpose. Sharing decides WHICH ROWS . CRUD and FLS decide which objects and fields. Never mix them up. Module map MODULE 3 root: 'Who can see which ROWS?' ├─ OWD (baseline) + Hierarchy (vertical) ├─ Sharing Rules (lateral) + Manual/Apex share (per-record) ├─ Restriction Rules (the ONLY subtraction) ├─ View/Modify All (OBJECT perm — OVERRIDES sharing) └─ with/without/inherited sharing (Apex enforcement) OWD & Role Hierarchy 💬 In plain words: Org-Wide Defaults (OWD) is the default lock on every record — start with the tightest setting the business allows. The role hierarchy then opens records UPWARD: managers see what their team sees. Everything else (sharing rules, manual shares) only ADDS access; nothing below OWD can remo...