11

I have an odd sharing requirement. I need almost all accounts to be public read/write for all internal users. A few accounts that are marked as private should only be visible to the owner and a few other specific users (basically a public group).

The issue is that the private accounts and their children should NOT be visible to users above those specific users in the role hierarchy.

Contacts and Opportunities are controlled by parent in this org so anything that hides the information for the account at the field level but leaves record level access would not work.

I was planning to do this by setting OWD for Accounts to Private and creating two criteria based sharing rules:

1) share out private accounts with those specific users.

2) share out all non-private accounts with all internal users.

The issue is that there's no way to disable the "grant access using role hierarchies" setting for accounts.

Is there any way to do this without having to take those users out of the role hierarchy?

  • 4
    The best option is probably to externalise the confidential information to a custom object related to Account and disable Grant Access via Hierarchy on that, sharing model Private and share only with those who need to see it via Ownership / Criteria based sharing. – techtrekker May 9 '13 at 9:41
  • @techtrekker The contacts and opportunities underneath private accounts should also be private so I would have to create custom objects for those as well and I have a bunch of custom child objects underneath the account that I would need to turn off "grant access..." for. The only thing I was able to come up with is just creating a new user that will be the owner of those specific accounts that only those people will have access to. – Greg Grinberg May 9 '13 at 16:58
1

Greg, it sounds more like a miss use of the Role Hierarchy. It is used for sharing objects and reporting; it is not meant to be the company role hierarchy.

It sounds to me like this is a Real Estate company or something similar and the agents do not want to let control of their clients or maybe for non-compete compliance reasons they shouldn't see each-others accounts.

Unfortunately this is a case where they will not be able to use the Role Hierarchy and you will need to make complex sharing rules or even apex sharing. This will also affect reporting as you will not be able to report on 'My Team' anymore. The customer needs to know these complexities and understand the trade offs.

In some instances there is no getting around this as there is legal reasons around it like conflict of interest, then Role Hierarchy needs reviewing to ensure privacy. If it is just a case that agents want to keep their personal clients, I would push to keep it open as that is the whole point of a CRM.

  • In general, the role hierarchy fits their model very well. It is just this one specific case of executives also being clients of the company that causes issues. I'll present the options. Was hoping there was some clever hack so that I wouldn't have to re-create role hierarchy with sharing rules/code. – Greg Grinberg May 13 '13 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.