What does Read/Write on Sharing Setting mean when Profile for Object is Read only?

Question

I was troubleshooting a scenario where a User was trying to create a Related Record (say Object A) on Opportunity which had a Master Detail relationship and was facing insufficient rights access issue.

Upon investigation I found the below configurations:

1. Opportunity on Profile is set to Read
2. Object A on Profile has CRUD access
3. OWD for Opportunity is Private (Object A because of M-D is Controlled by Parent)
4. Opportunity was shared with the User using a Sharing Rule with "Read" access only
5. The way M-D relationship was set on Object A is as below (and honestly I didn't know it can have an impact):

It seemed like because of the Sharing Rule where the User here had a "Read" access only on the Opportunities and because of the way the M-D relationship was set, they were not able to create the related record on Opportunity.

The time I extended the Sharing Rule to "Read/Write", it worked fine.

This is what leads to my question (I may be completely missing something very basic here):

What does "Read/Write" access on Sharing Rule really signify if an Object has only "Read" access on the Profile and that the record can actually never be edited?

Note that if the Sharing Setting definition on the M-D field was set to "Read" only, then this worked perfectly fine. In this case the master record didn't require to be shared as "Read/Write" necessarily. The whole point of sharing the master record as "Read/Write" really seems redundant here. And it just seems the overall issue is where while creating the detail record, the system validates the "access level" on Sharing Setting irrespective of if the Object itself is set to "Read" only on profile.

Answer 1

What does "Read/Write" access on Sharing Rule really signify if an Object has only "Read" access on the Profile and that the record can actually never be edited?

You'll want to read Sharing Considerations for most of the usual complications of sharing.

However, for the purpose of this question, it's important to make a distinction. A feature that requires a certain Sharing level of access to the record does not evaluate Profile Permissions regarding that feature. You can have Edit access to a record without having the Edit Object Profile Permission for that object.

If you have Edit access to an Opportunity, you can do all of the Edit-level features to that Opportunity, even if they can't edit the Opportunity itself because of Profile Permissions.

For example, the user can add Notes and Attachments, add Opportunity Team Members, Contact Roles, and so on, even if the Profile Permissions don't allow editing any Opportunity.

Answer 2

sorry for necroposting , but found this while studying for a certification. After experimenting in my practice org due to an exam (mock) question, this is my take on your question.

What does "Read/Write" access on Sharing Rule really signify if an Object has only "Read" access on the Profile and that the record can actually never be edited?

The "read/write" option on sharing rules signify that, if said profile had any additional object permissions than "read", the user that the records are shared with would be able to perform those operations on the shared records, as well. It does not give additional object permissions, just kind of "honors" what the profile will allow.

The "read only" option would grant access to records while limiting operations to read, even to a user with additional object permission.

the system validates the "access level" on Sharing Setting irrespective of if the Object itself is set to "Read" only on profile.

I assume you mean the master Object (in your example, Opportunities)? That seems right. The "sharing setting" on the M-D relationship will looks at the sharing mechanism used to share the record and if the option "read only" or "read/write" has been used, not if the user can actually write on the master object itself.

Which is kind of counter intuitive, I do agree with you.

Best, Jean