Trail Map › Use-Case Catalog › Profiles & Permissions
🔐 Security · Module 05

Profiles & Permissions: Lock Data Down by Role, Not by Trust

Some data is sensitive — like how much a deal is worth. Your Finance team should see it. An SDR (Sales Development Rep, someone who just qualifies new leads) shouldn't. The simple two-layer system that controls who sees what, so it's a quick settings change — not an awkward conversation.

4
Tabs
~12 min
Time to Complete
80 pts
Available
1 Badge
Access Control Architect

Why fine-grained permissions matter

CF
Chris Fenwick · CFO

"Our Finance team needs to see contract values on every Opportunity (that's our word for a deal in progress), so they can report revenue correctly. Our SDRs — who just qualify leads — absolutely should not see that number. I don't want to rely on people just 'not looking.'"

You can't keep sensitive data private just by asking people politely not to look. That doesn't scale to hundreds of users, and it won't hold up if anyone ever audits your data. The system itself has to enforce who sees what — the same way, every single place that data could show up.

💡
What this means for you
Sensitive fields stay hidden everywhere — on record pages, in reports, and anywhere else the data could appear. Changing who sees what is just a settings change. You don't need a developer to do it.

Anatomy of the two-tier model

Think of a Profile like a job badge at a building. It decides which doors you're allowed to open. Every user must have exactly one Profile, and it sets their baseline access — the access level they start with. A Permission Set is like a temporary keycard add-on: it can unlock a few extra doors for one person, but it can never take a door away that their badge already opens.

LayerControlsCan it take away access the other layer grants?
ProfileWhich objects (record types, like Lead or Opportunity) and fields a user can create, view, edit, or delete; which apps and tabs they can see; system-level settingsN/A — this is the baseline everything else builds on
Permission SetExtra access added on top, for specific usersNo — it can only add access, never remove what the Profile already grants

A few important Profile settings ("flags") to know:

FlagEffect
isSystemAdminGives full access to everything — skips every other permission check
canViewAllData / canModifyAllDataLets someone see or edit every record in the org, no matter who owns it
canCustomizeApplicationLets someone manage objects, fields, layouts, and apps
marketingAccessUnlocks access to Marketing Studio, SmartLite's marketing tool
✅
The ADMIN role is special
A user's ADMIN role is different from their Profile. Someone with the ADMIN role skips profile checks completely — it doesn't matter what their assigned Profile says, they can do anything. This is useful for the people who run the whole platform, but hand it out carefully and sparingly.

1 Hide a sensitive field from one profile

Create the profileGo to Setup (the admin settings area) → Profiles → New Profile. Name it "Standard Sales User" (or start from a copy of an existing profile).
Set object permissionsAllow Read, Create, and Edit on Opportunity. Deny Delete.
Hide a fieldOpen Field Permissions, find contract_value__c (or any sensitive custom field), and uncheck "Can Read" for this profile.
Assign itAttach the profile to a test user, then log in as that user to see it from their point of view.
VerifyOpen an Opportunity as that test user. The hidden field should not appear anywhere on the page.
🎯
Try a Permission Set
Create a Permission Set that grants Delete on Opportunity, and attach it only to your team lead. Notice how it adds that one extra ability without needing a whole second profile.

Day-to-day: everyone

Work within your access, no frictionYou just see the fields and objects your Profile grants — nothing to configure yourself.

Day-to-day: admins

Add a new profile for a new roleWhenever a new job function joins the team, clone the closest existing profile and adjust.
Grant a one-off exception with a Permission SetDon't build a whole new profile for a single person's extra need — add a Permission Set instead.
🎯
What to try next
Continue to the Sharing Rules & OWD trail — Profiles control what a user can do with a record type in general; Sharing Rules control which specific records they can see.

Test what you learned

1. Can a Permission Set take away access that a user's Profile already gives them?
Yes, permission sets can restrict below the profile
No — permission sets can only add access, never remove it
2. Which flag gives a profile completely unrestricted access to everything?
canViewSetup
isSystemAdmin
marketingAccess