I thought I had a pretty good handle on security in SF. Have received a requirement that I can't seem to meet with no code.

Basically OWD - Accounts, Contacts and Opportunities are all Private.

Role is setup to be able to Read all Opps/Contacts associated with accounts they own.

Business wants all users to see all Account records but only be able to create/edit Contacts/Opportunities on Accounts they do not own if they are added to the Account team. This requirement does not include executives who are above the team in the role hierarchy - just users whose role is not above the account owner's role.

I tried creating sharing rule on Accounts to allow Read access to accounts for all users. But when I do that all users with permission to create opportunties in general can create Opps on Accounts they do not own.

Maybe I'm missing something obvious???

  • So you want users to be able to read everything on Accounts but not be able to edit unless they are above the person in the hierarchy correct? Feb 9, 2016 at 20:16

1 Answer 1


I was able to meet the business requirements by enabling Account Owner Report feature under accounts object. Users can run this report to see all Account data but cannot access the actual Account records without being added to sharing for the Account (we're doing this using Account teams).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .