I have an odd sharing requirement. I need almost all accounts to be public read/write for all internal users. A few accounts that are marked as private should only be visible to the owner and a few other specific users (basically a public group).
The issue is that the private accounts and their children should NOT be visible to users above those specific users in the role hierarchy.
Contacts and Opportunities are controlled by parent in this org so anything that hides the information for the account at the field level but leaves record level access would not work.
I was planning to do this by setting OWD for Accounts to Private and creating two criteria based sharing rules:
1) share out private accounts with those specific users.
2) share out all non-private accounts with all internal users.
The issue is that there's no way to disable the "grant access using role hierarchies" setting for accounts.
Is there any way to do this without having to take those users out of the role hierarchy?