I was in a meeting today, and I was explaining the security model for some new objects. I was saying that we're set the Org wide defaults as private and open up record access by sharing rules and role heiarchies... no biggie.

I was asked if this is a bottom up or top town security model... I don't know what either meant, nor which is used in Record level security.



I'd say bottom - up as the OWD controls what the most restricted user can see and sharing rules, et all open up this access. (Funnel-shaped)

Also access to records rolls upwards along the role hierarchy so that managers can see everything their team can see (as long as grant access via hierarchies is enabled)

enter image description here

  • 4
    This wikipedia article agrees with you. Seems like irrelevant business man language to me. – Phil Rymek May 15 '13 at 18:41
  • Thanks Phil, I wasn't familiar with those terms either, just tried to make sense with how we understand the security model. – techtrekker May 15 '13 at 18:47
  • OWD is the most restrictive part of security, so putting it above Profiles is false. – DavidSchach May 19 '13 at 23:53
  • If you think about it, Profiles are even more restrictive, coz you wouldn't be able to see the Object if your profile didnt permit it ! Data wise, yes OWD is the most restrictive. – techtrekker May 20 '13 at 13:30

Bottom line: The only way to limit security is to use OWD, and then every other security feature opens up security. I'm not a fan of the inverted pyramid image because it implies that Sharing Rules open up visibility that Profiles closes... but that is not true. Profiles open up security that OWD sets at its most restrictive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.