How to restrict record access from users who are on same level in role hierarchy

Question

I have role hierarchy defined as follow,

 A    {CEO Role}
B C   {Principle Role}
D E   {Manager Role}

My OWD is Private, but still, - B can see E's Data - C can See D's Data.

How can I restrict that?

Answer 1

If you disable the Grant Access Using Hierarchies option, sharing with a role or territory and subordinates only share with the users directly associated with the role or territory selected. Users in roles or territories above them in the hierarchies will not gain access.Controlling Access Using Hierarchies

Answer 2

B is above E in the hierarchy, and C is above D. That's why they can see the records. It doesn't matter if E reports to C and D reports to B.

As an example, suppose you have Sales and Support teams, all of whom have the Sales Analyst or Support Analyst role. Both roles are parented under the Team Manager role. The Sales person with the Team Manager role can see records owned by both teams, as can the Support person. You'd need to have separate Sales Team Manager and Support Team Manager roles for the two Managers to separate their visibility, and parent their direct reports' roles under those separate roles.

This is one of the critical points to remember that the role hierarchy and its associated visibility effects do not follow the org reporting chart.

As Eduard points out, there are many other sharing tools that can provide visibility, such as View All / Modify All, sharing rules, and so forth.