Why record-level sharing matters
RN
Robin Nakamura · RevOps Lead
"We have five regional sales managers. Each one should only see deals in their own region — but our VP of Sales needs full visibility across every region, every rep, all the time."
Object-level permission ("can this user read Opportunities at all?") isn't enough here — the real requirement is row-level: which specific Opportunities can this user see?
Business outcome
Every rep and manager sees exactly the deals relevant to them, while the org's default posture stays the safe, restrictive option — access is expanded deliberately, never leaked by accident.Anatomy of the sharing model
Three layers combine to decide exactly which records a given user can see:
| Layer | What it sets |
|---|---|
| Organization-Wide Default (OWD) | The baseline for an object: PRIVATE, PUBLIC_READ, or PUBLIC_READ_WRITE |
| Role Hierarchy | When enabled on an object, a manager automatically sees every record owned by their direct reports, recursively |
| Sharing Rules | Explicit, criteria-based or manual grants that expand access beyond OWD for specific users or groups |
| OWD Level | Who can read | Who can edit |
|---|---|---|
| Private | Owner only | Owner only |
| Public Read | All org users | Owner only |
| Public Read/Write | All org users | All org users |
One-directional by design
Sharing Rules can only expand visibility beyond OWD — they can never restrict it further. If you need tighter default visibility, lower the OWD itself.This same visibility resolution — SharingService.resolveVisibleOwners() — is reused everywhere: record lists, record detail pages, and Reports. Configure it once, and it's enforced consistently across the entire platform.
Set up regional visibility on Opportunity
Open Opportunity sharing settingsObject Manager → Opportunity → Sharing tab.
Set the OWDChange it to Private — the safe, restrictive default.
Enable Role HierarchyToggle "Use Role Hierarchy" so managers automatically see their reports' deals.
Add a Sharing RuleCriteria:
region__c = "West", shared with: West Region Manager, access: Read/Write.Verify as a repLog in as a West-region sales rep and confirm you only see West-region Opportunities in your list.
Test what you learned
1. If the OWD for Opportunity is Private, can a Sharing Rule make it stricter — say, hiding it even from the owner?
Yes, sharing rules can restrict below OWD
No — sharing rules can only expand access beyond OWD, never restrict it
2. What does
resolveVisibleOwners() returning null mean?The user can see no records at all
The user can see all records — no restriction applies
An error occurred resolving visibility