In Salesforce, we always start with "Lock it down" and then "Open it up." Here is how to master the layers of visibility.
Underlying Object & Field Level Permissions
The Org-Wide Default (OWD) serves as the strategic baseline for record access, defining the standard visibility for every object before any sharing expansion occurs.
Whenever sharing settings are modified, they are recalculated for all the existing records.
A notification email is sent automatically once the recalculation process is completed.
You can define the sharing separately for external users. This provides maximum flexibility to configure access specifically for partners.
Best Practice:
Set the object to Private for external users and Public Read Only or Read/Write for internal users.
Note: The default external user access can either be equal or more restrictive than the internal access configured.
Highly restricted access for unauthenticated public users visiting your sites.
Implies a **Master-Detail** relationship where the child inherits security settings directly from the parent.
Visualizing data visibility through building architecture.
"Solid Walls: Only your own office is visible."
"Glass Walls: See everything, touch nothing."
"Open Doors: Full collaborative access to every room."
Access Inherited Upward
To grant access to people above our role in the hierarchy ladder, we can select the 'Grant Access using hierarchies' option.
This enables access for any user above the current role in the vertical chain. For Custom Objects, this feature can be toggled to restrict hierarchical access if needed.
If users have View all Data or Modify all Data permissions, the access is automatically available even if the hierarchy checkbox is unchecked.
Relationship Transition
If a child object is **removed** from a master-detail relationship, the system automatically adjusts its standalone security profile.
Dynamic Recalculation
User movements within the hierarchy trigger immediate background security updates.
"When a user’s role is changed, the sharing rules are automatically reapplied based on their new position in the hierarchy."
System-level automation ensures data integrity