1

Upon changing the case access of a child role from "can edit all cases associated with accounts that they own" to "cannot access cases that they do not own" a user can no longer access a case. However, to my understanding this user does NOT own the account associated with this case.

Where in this configuration does this user implicitly gain ownership? Are they getting it from the Account Read/Write in the sharing settings, does that qualify as ownership?

Setup:

Roles:

Top Level Sibling Role: Role 1
Users in this role can edit all contacts and cases associated with accounts they own. 

Child Role to Role 1: Child Role
*Users in this role can edit all cases associated with accounts that they own, regardless of who owns the cases*

Top Level Sibling Role: System Administrator
Users in this role can edit all contacts and cases associated with accounts they own.

Case Record:

RecordType: Type A (Record Type not explicitly shared to Current User's Role (Child Role))
Queue: (Queue that Current User (Role: Child Role) is not a member Of)
Related Contact Owner Role: Role1
Related Account Owner Role: System Administrator

Sharing Settings:

Default Internal External is set to Private for all objects. 

Account (Role 1 & Subordinates): 
Contact - ReadOnly | Case -  Read/Write
Grant Access Using Hierarchies = TRUE

Contacts(Role 1 & Subordinates): 
Contact - ReadOnly | Case -  Read/Write
Grant Access Using Hierarchies = TRUE

Cases(Shared by Case Record Type):
Type A is NOT shared to Child Role 
Grant Access Using Hierarchies = TRUE
Improve this question

1 Answer 1

Reset to default
2

Where in this configuration does this user implicitly gain ownership?

If a User has access to a Case record or they own one (irrespective of any record type) and even if they don't own the Account associated to that Case or have any explicit sharing defined for the Account, the User will always have an implicit Read Only access on the Account.

This is documented in Built-in Sharing Behavior:

Salesforce provides implicit sharing between accounts and child records (opportunities, cases, and contacts), and for various groups of portal users.

Sharing between accounts and child records

  • Access to a parent account—If you have access to an account’s child record, you have implicit Read Only access to that account.

You can also find details on this topic on Implicit Sharing on Designing Record Access for Enterprise Scale docs.

Improve this answer
6
  • So because the account is shared to this role by sharing account sharing settings they technically "own" that account even though there is a different "account owner"?
    – S.B.
    Commented May 2, 2019 at 14:59
  • 1
    I don't see any account sharing here. Even if it was shared, an Owner can be only a Queue or a User. What I am trying to say is that even if a User A doesn't have access to Account ABC, but if A owns a Case C (or has access to it by other sharing means) which is associated to ABC, then A will also have a read only implicit access to ABC. Clarifies?
    – Jayant Das
    Commented May 2, 2019 at 15:01
  • I'm sorry, but not quite... my concern is not with the user accessing the account, my concern is with access to the case. Since they don't "own" the account to my knowledge, it's not clear to me why I have to switch to "Users in this role cannot access cases that they do not own that are associated with accounts that they do own".Because I am switching this rule, it gives or takes access to the case which indicates to me that salesforce thinks this user owns the account and I cannot determine why.
    – S.B.
    Commented May 2, 2019 at 15:28
  • 1
    It depends on how you want your Users on a role to be able to access the Cases associated to a particular Account owned by someone else in that Role. This rule is particularly driven by Business Rules. This rule does not have anything to do with Account sharing here but only Case access to others associated with that Account. Salesforce doesn't think that the User owns the Account if you change that rule, Salesforce only implicitly grants access to the Account associated to a Case that the User owns .. irrespective of their position in the role hierarchy.
    – Jayant Das
    Commented May 2, 2019 at 15:35
  • I'm not following the terminology "Business Rules". What are you referring to? Are these the rules on the role itself?
    – S.B.
    Commented May 2, 2019 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .