I am going through the "Development with the Force.com Platform" book and have run into an issue when implementing the sample application from the book.

The example is to demonstrate manual sharing:

  • Two employees from the example organisation have separate roles: West and Central
  • The employee with the West role has owner ship of a Resource record and creates a manual share with Read Only permissions so that anyone with the Central role can read the record.
  • The employee with the Central role then has to create an Assignment record which involves using the shared Resource record and a Project record which he is the owner of.

Unfortunately when I try to do this (logged in as the Central user). I get the following message:

Insufficient Privileges. You do not have the level of access necessary to perform the operation you requested

What I have checked:

  1. That there is a manual sharing rule for that Resource which shares with Central role.
  2. That the when logged in as the Central user, I can read the record. Which I can.
  3. I have tried setting the Central users role to West (the same as the Resource owners') and the Assignment can then be created OK.
  4. I have checked that the user is indeed set as having the Central role.

I really don't see what else it could be. Does anyone have any suggestions?

Rather than just suggestions, though, is there a way that I can find out exactly which security settings are denying this operation? Some debugging perhaps?

Many thanks

  • When exactly are you receiving this error message? Can Central view West's Resource record? Can Central open a new Assignment record screen? Can Central save the new Assignment record? Sep 10, 2012 at 20:34
  • 1
    I think the title of this question should be changed. The answers here do not answer the question stated in the title, instead they provide very specific things to check. None of the answers say how to find the reason for the privilege error. Oct 23, 2014 at 19:05
  • This is crazy. I've wasted hours today trying to just figure out why a user's privileges are insufficient. If only Salesforce could tell me why the user has insufficient privileges instead of me trying guess and check for hours.
    – Gillespie
    Aug 16, 2021 at 19:55

3 Answers 3


Maybe try checking the Central user's access to whatever record type your unable to create. Check at the profile and object level.

Also when you try to create a share when the resource (object privacy) is already 'public read only' -- the DML throws an arbitrary exception - so also check the record is set to private

  • Hi. Sorry for the delay in getting back to this, but thanks for your reply. When you say check the access "at the profile and object level", what do you mean? I have checked the profile and confirmed that it has access to the object. Is there another part of object-level security that I'm not thinking about here? The sharing rule is in place. The organization-wide default is private. The Central user definitely has access to the Resource object - it can read it. I'm sure that this is something stupid but I'm not sure what. Shame there isn't a sys admin function to say why the user's denied
    – Joe
    Sep 12, 2012 at 19:38

Kind of depends on what Profile the employee you are using has....

According to the diagram on page 51, Assignment, being an intersection object is the child of both Project and Resource in a Master-Detail relationship and thus inherits access from the Master.

Looking at page 78 in the book, Sales Rep and Consultant only have "Read" access to the Master records and do not have create access for the Assignments. They both already have read access to Resource.

In fact everyone has read access for Resource, so your sharing rule is not necessary and might cause errors as mentioned above.

Only the Staffing Coordinator and Vice President profiles have the appropriate access to create an Assignment record, so regardless of sharing, only these two Profiles can create Assignment records.

  • Hey thanks for your reply. The user trying to create the assignment is a Staffing Coordinator, so he has the rights as you mention. Everyone does have object read access, but I did not mention that the organization-wide default access level is private, so a user will only be able to read a Resource which they are not the owner of by sharing rules or the role hierarchy.
    – Joe
    Sep 12, 2012 at 19:31

I am not familiar with anyway to debug that. And I know you asked not for mere suggestions, but that's about all we can do.

You will just have to go over the settings again -

security (for profiles as well as roles)
sharing - yea, check again
views (if they use different ones) - to note, I am not familiar with that "book" that you follow, so don't know.    

Have a look at the following idea on ideasexchange - I believe that if this will get implemented, most of our problems (well not most - maybe some) will be sorted

Insufficient Privileges - Tell me why

  • 3
    It would be great if they could implement that functionality!
    – Joe
    Sep 12, 2012 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .