Security · Module 13
Sharing Rules & OWD
The Right Records, Not Just the Right Screens
A Profile decides what a user is allowed to see across a whole type of record — say, Opportunities in general. Sharing rules decide which specific Opportunities they actually see. How these two work together to control access.
About & Business Case #
Why record-level sharing matters #
"We have five regional sales managers. Each one should only see deals in their own region — but our VP of Sales needs full visibility across every region, every rep, all the time."
Just knowing "can this user read Opportunities at all?" isn't enough here. What really matters is a more specific question: which Opportunities can this particular user see?
What this means for you
Every rep and manager sees exactly the deals that matter to them. The org's default setting stays safe and restrictive by default, and access only ever gets expanded on purpose — never leaked by accident.
Implementation #
Anatomy of the sharing model #
Three layers combine to decide exactly which records one user can see. Think of it like a building: the Organization-Wide Default sets which doors are locked by default, Role Hierarchy gives managers a master key to their team's doors, and Sharing Rules hand out extra keys one at a time.
| Layer | What it sets |
|---|---|
| Organization-Wide Default (OWD) — the starting, most-restrictive setting for an object | Either PRIVATE, PUBLIC_READ, or PUBLIC_READ_WRITE |
| Role Hierarchy — your company's reporting chain, from rep up to manager up to director | When turned on for an object, a manager automatically sees every record owned by the people who report to them — including people further down the chain |
| Sharing Rules — extra rules an admin sets up by hand | Give specific users or groups more access than the default setting, either by matching criteria or by picking people manually |
Here's what each OWD level actually means for who can see and change a record:
| OWD Level | Who can read | Who can edit |
|---|---|---|
| Private | Owner only | Owner only |
| Public Read | All org users | Owner only |
| Public Read/Write | All org users | All org users |
One-directional by design
Sharing Rules can only add visibility on top of the OWD — they can never make it stricter. If you need a tighter default for everyone, lower the OWD itself instead.
This same visibility check happens everywhere: record lists, record detail pages, and Reports. Configure it once, and it's enforced the exact same way across the entire platform.
1 Set up regional visibility on Opportunity #
region__c = "West". Shared with: West Region Manager. Access: Read/Write.How to Use #
Day-to-day: reps and managers #
Day-to-day: RevOps and admins #
What to try next
Look at the Profiles & Permissions trail if you haven't yet — it covers the layer above this one, deciding what a user can do with a record type in general.