Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I know with permission sets and sharing rules you can limit visibility and how users can interact with entire records. IS there any way to limit visibility of fields? We are looking to make the basic details of records available to everyone but for people with the same role we want details to only be available to the owner and people higher up in the hierarchy.

I'm imagining this will have to be a customized detail page using Visualforce, but wanted to see if anyone knew of an approach that didn't require development.

share|improve this question
    
Can you consider moving this "sensitive" data to objects related to the main one? Not via master-detail, weak lookup so you still have OwnerId on child records. Public Read Only on the "main"; "Private + grant access using hierarchies" on the "details" ought do the trick... –  eyescream Nov 17 '12 at 17:58
add comment

5 Answers

up vote 2 down vote accepted

No, this isn't possible. You either have Read-Only or you have Read/Write access to a field. This does not change with ownership of records. Depending on your use case you may be able to pull it off via a Visualforce page which dynamically shows fields depending on ownership.

Please note, though: Regular field-level security will still apply when users run reports, i.e. if they have field-level access to a field, they will be able to see the value of it in reports for any record they have access to.

share|improve this answer
    
Field level security can be used to hide a field completely. But as you said, not by owner. –  Daniel Blackhall Nov 19 '12 at 21:08
add comment

Kind of. You can set field-level permissions by Profile and by Permission Set. You could set a base profile with the least access and then add access by permission set to those that need increased visibility.

share|improve this answer
    
I think the problem we run in to is that we can't control visibility by owner. People would either see the complete view or minimum view of all records of a particular type. It doesn't seem like this approach could be used to let a user only see the complete view of THEIR records and a partial view of records they don't own. –  Ryan Elkins Nov 17 '12 at 16:52
    
That's true, unless you're using different Record Types. –  Mike Chale Nov 17 '12 at 17:46
add comment

The short answer is no - there is no concept of dynamic field level security which is conditional in nature (e.g. show the field if I own the record or above the record owner in the role hierarchy but hide it from everyone else). As the other posts indicate, FLS is a static permission that crosses all conditions and is tied in positive fashion to a user.

However, there are some work around solutions. For instance, before binding a field in a visualforce page, you can put a conditional in place around an attribute of the current user including their profile (e.g. if System Admin, show field, otherwise hide it). This is security through obfuscation since non-visualforce interfaces that read this record would of course show the field (e.g. search, reports, list views, etc...).

share|improve this answer
    
This is captured in a an Idea that is "Under Construction" - success.salesforce.com/ideaView?id=08730000000BroxAAC. Adam, any update on dynamic/dependent page layouts??? –  Justin J Carlson Nov 20 '12 at 15:25
    
Thanks @JustinJCarlson for posting the idea!!! I hope everyone votes for it! Right now, dynamic page layouts is not on the near term (next 3 releases) roadmap as far as I know (I don't own that particular enhancement). Dynamic field level security is also not on the near term roadmap (I do own that one). –  Adam Torman Nov 29 '12 at 23:46
add comment

The profiles are something through which you can handle this .You will have to get away with roles and somehow manage with profiles to achieve this requirement.Field level security applies for profile and roles have no control over field visibilty.May be having different profiles may help here

share|improve this answer
add comment

Easy way out of this would be to just use profiles and have different page layouts for each profile. This was you can hide certain fields from others. But it does not work the suggested, ie. you can't do it by role. If the owner has a limited profile, he or she will only see those fields the page layout shows.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.