2

I have a child object X. A particular field of object X can only be seen by user who created the record and manager of the user.

Current sharing settings config for object X:

  1. In Sharing settings, i put default internal access as Private (I believe this controls sharing setting for object).
  2. Grant Access Using Hierarchies -set to TRUE

Above 2 settings control the whole object's access but i'm looking at restricting a particular field. May be i'm missing something which is pretty straight forward?

Improve this question

2 Answers 2

Reset to default
3

There is no way to achieve the desired result declaratively.

Field level security cannot be changed on a per record basis. A user has the given level of access to said field on all records they can access.

The closest I could imagine would be to put the sensitive data in a child object, and use apex managed sharing to grant access to that child record to the owner + hierarchy (the hierarchy bit w managed sharing might be tricky - that is not my expertise).

UPDATE Instead of managed sharing, you could just use process builder to sync the parent record owner w the child record. Then you can set the org wide defaults on child to private, and check the share w hierarchy option, which would share these records up the role (not manager) heirarchy.

Another option could be using a visualforce page or component running in system mode to determine how to display that field. This however would not allow for reporting on that field.

Also note that formula fields don't evaluate field level security for the fields they reference. So a formula field could determine if running user equals owner, then display the value, else blank. This would w the VF option, or w the child record option if you add logic to write the value from child to the hidden field on parent which is referenced by the formula field.

One final note - grant access using hierarchies grants access via the role hierarchy, not the manager hierarchical relationship field on user. Manager sharing is now supported declaratively, but last I looked it had to be set per user, and couldn't be set to share all records of said object w the record owners manager.

Improve this answer
2
  • Thank you for the work around. But in my case i cant take this field into an other child object as this object X is child of Contact and all data needs to be in the related list of Contact. I will most probably control access of record instead of the field as time is a constraint.
    – night crawler
    Commented Apr 18, 2017 at 18:17
  • Makes sense. In theory, if it's a small number of fields, you could write the data from the child object to hidden fields on contact, and use the formula field trick to control visibility. That said controlling record level access sounds better to me!
    – gorav
    Commented Apr 18, 2017 at 19:57
0

Think through method of elimination to find the right approach.

  1. Sharing Setting - which you have already done, governs the record level access and does not apply for field level access. So, whoever get access to the record will see the field. This will not solve your purpose.

  2. Visibility of the field on layout governed by profile. Here FLS will not solve your purpose as Owner and other users can share the same profile.

  3. What if, the field can be shown in 2 different page layouts where owner and his manager can see the layout which contains the field and other can see the different page layout. This recordtype will govern the page layout assignment.

Think about that, if you are trying to create separate profiles and recordtypes and page layout assignment for your purpose.

Improve this answer
1
  • While this would provide superficial privacy, anyone w access to the record could see the field value in a report or list view.
    – gorav
    Commented Apr 18, 2017 at 1:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .