📖 Read · 20 XP
Role hierarchy and sharing rules
Role hierarchy and sharing rules
Once OWDs are locked down, here's how you open access back up.
The role hierarchy
Roles mirror your org chart (roughly). With Grant Access Using Hierarchies on (it always is for standard objects), managers inherit access to records owned by people below them.
CEO
└── VP Sales
├── Sales Manager EMEA
│ └── Sales Rep EMEA ← owns Opportunity X
└── Sales Manager APAC
The EMEA Sales Manager, VP Sales and CEO can all see Opportunity X. The APAC manager can't.
⚠️ Roles control record visibility. Profiles control what you can do. Don't mix them up.
Sharing rules
For access that doesn't follow the org chart:
- Owner-based: "records owned by the Support group are shared with the Success role"
- Criteria-based: "Accounts where
Region__c = 'EMEA'are shared with the EMEA Partners group"
Sharing rules grant Read Only or Read/Write, and they only ever open up access.
Everything else
| Mechanism | Use |
|---|---|
| Public groups | Collections of users/roles to share with |
| Queues | Ownership by a team (Cases, Leads) |
| Teams (Account, Opportunity, Case) | Per-record collaborators |
| Manual sharing | The owner clicks Share |
| Apex managed sharing | Code writes __Share records for complex logic |
Why developers care
Apex runs in system mode by default and ignores all of this unless you ask it not to. In the Triggers & Async track you'll learn with sharing, WITH USER_MODE and friends, and why forgetting them is a security bug.