I thought I had a pretty good handle on security in SF. Have received a requirement that I can't seem to meet with no code.
Basically OWD - Accounts, Contacts and Opportunities are all Private.
Role is setup to be able to Read all Opps/Contacts associated with accounts they own.
Business wants all users to see all Account records but only be able to create/edit Contacts/Opportunities on Accounts they do not own if they are added to the Account team. This requirement does not include executives who are above the team in the role hierarchy - just users whose role is not above the account owner's role.
I tried creating sharing rule on Accounts to allow Read access to accounts for all users. But when I do that all users with permission to create opportunties in general can create Opps on Accounts they do not own.
Maybe I'm missing something obvious???