Why record-level sharing matters
"We have five regional sales managers. Each one should only see deals in their own region — but our VP of Sales needs full visibility across every region, every rep, all the time."
Just knowing "can this user read Opportunities at all?" isn't enough here. What really matters is a more specific question: which Opportunities can this particular user see?
Anatomy of the sharing model
Three layers combine to decide exactly which records one user can see. Think of it like a building: the Organization-Wide Default sets which doors are locked by default, Role Hierarchy gives managers a master key to their team's doors, and Sharing Rules hand out extra keys one at a time.
| Layer | What it sets |
|---|---|
| Organization-Wide Default (OWD) — the starting, most-restrictive setting for an object | Either PRIVATE, PUBLIC_READ, or PUBLIC_READ_WRITE |
| Role Hierarchy — your company's reporting chain, from rep up to manager up to director | When turned on for an object, a manager automatically sees every record owned by the people who report to them — including people further down the chain |
| Sharing Rules — extra rules an admin sets up by hand | Give specific users or groups more access than the default setting, either by matching criteria or by picking people manually |
Here's what each OWD level actually means for who can see and change a record:
| OWD Level | Who can read | Who can edit |
|---|---|---|
| Private | Owner only | Owner only |
| Public Read | All org users | Owner only |
| Public Read/Write | All org users | All org users |
This same visibility check happens everywhere: record lists, record detail pages, and Reports. Configure it once, and it's enforced the exact same way across the entire platform.
1 Set up regional visibility on Opportunity
region__c = "West". Shared with: West Region Manager. Access: Read/Write.