If for a user profile permissions are read only on an object, and Org-wide defaults permissions on that object are public read/write then what can users with that profile access? How do these permissions interact?
asked Dec 19, 2014 at 17:19
Add a comment
|
1 Answer
Organization-Wide Defaults control the sharing of a record whereas the Profile Permissions defines what each profile can do with the shared record. So your read only user would only be able to read the records and not modify them but they would be able to read records they do not own. If they did not have read on the object then they would not be able to access the records at all.
Organization-Wide Defaults
Your organization-wide default sharing settings give you a baseline level of access for each object and enable you to extend that level of access using hierarchies or sharing rules. For example, you can set the organization-wide default for leads to Private if you only want users to view and edit the leads they own. Then, you can create lead sharing rules to extend access of leads to particular users or groups.
Profile settings respect the sharing rules but modify all and view all will override the sharing settings, allowing that profile to view all records regardless of sharing or modify all records regardless of sharing as noted in the docs here:
