📖 Read · 20 XP
Org-wide defaults and record ownership
Org-wide defaults and record ownership
Salesforce security is an onion with four layers, and you need all of them in your head:
- Org access: can you log in at all? (users, login hours, IP ranges)
- Object access: can you read/create/edit/delete Accounts at all? (profiles, permission sets)
- Field access: can you see
Salary__c? (field-level security) - Record access: can you see this particular Account? (sharing)
This chapter is about layers 2 to 4. It starts with record ownership.
Every record has an owner
Most records have an OwnerId, either a user or a queue. The owner always has full access.
Org-wide defaults set the baseline
OWDs answer the question: "What can people see of records they don't own?"
| OWD | Meaning |
|---|---|
| Private | Only the owner (and people above them in the role hierarchy) |
| Public Read Only | Everyone can see, only the owner can edit |
| Public Read/Write | Everyone can see and edit |
| Controlled by Parent | Detail records follow their master (master-detail) |
The golden rule
Lock down with OWDs, then open up. You can't use sharing rules to take away access granted by an OWD. Set the OWD to the most restrictive level any user needs, then grant access with:
- The role hierarchy
- Sharing rules
- Teams and manual sharing
- Apex managed sharing (code)
🦝 Why do devs care? Because
with sharingin Apex enforces exactly these rules, and the PD1 exam loves asking about it.