Is this a fair assessment to say that Role only restricts data, while Profiles can be used to restrict most everything else, like UI, Object and field permissions, functional capabilities?

  • NB - Salesforce uses a permissive sharing model, not a restrictive one. It is impossible to restrict access beyond the Org-Wide Default access level. – Adrian Larson Jul 22 '16 at 16:59

Roles : Roles control Records

OWD is the foundation which decides whether our data is setup in Private / Public Read Only or Public Read Write. This is the most restrictive data setting.

When the OWD is Private, Sharing Rules become available to open up the OWD data restrictions to groups of users or roles and subordinates. These can either be ownership based or criteria based(with some limitations)

Another way to share data is through Apex sharing where you can programmatically insert share records based on custom logic too complex to encapsulate as Criteria Based Sharing Rules.

User Role Hierarchy

Profiles :

Profiles control what you can do with the data that is visible to you, certain administrative permissions and of course which objects in the schema you have access to.

Field Level security for example lets you control at a Profile Level which fields are visible or read only to certain profiles.

The View All Data and Modify All data permissions on the Profile are exceptions because they bestow 'SuperCow Powers' on the users with that Profile. Hence why they are normally granted only to Full System Admins.

See User Profile Permissions

Permissions sets:

Permissions sets are a way to provision profile permissions in a modular fashion so you can group a bunch of related permissions. Permission sets supplement the permissions already granted to a user by virtue of their user profile.

Additionally Profiles also control which Apex Classes and Visualforce pages you have access to.

Profiles and Permission Sets are essentially the same container with only one key difference - a user may have one and only one profile but that same user may have 0, 1, or many permission sets.

| improve this answer | |
  • 4
    And, of course, in addition to apex sharing, sharing rules, and roles, there's implicit sharing, parent sharing, territory sharing, etc. It only takes one sharing reason to have access to a record, and that's not necessarily by ownership. – sfdcfox Jul 21 '16 at 18:27
  • Thanks! Okay I see it. Roles grant, not restrict, and only for data, yes? In the MVP scheme would it be too far a stretch to say Roles are used to control security of the model, and Profiles and Permission sets for the view and controller? – davea0511 Jul 22 '16 at 5:39

What? No.

Roles do not restrict anything they only grant you access. Think about a blank profile with nothing checked in object or UI things like API access or being able to email or run reports. You cannot do anything.

As you check more and more options and more and more objects and fields you can see and do more things so a profile gives you access to what you can do inside Salesforce.

The role with the role hierarchy is what you can see in Salesforce. Sure you can own a record and see it but what about the other people how can you see their records that they own? Based on your role and sharing settings it allows you to see more records.

There are no options in role or profile that restrict only allow. profile allows what you can do, role allows what you can see.

| improve this answer | |
  • Thank you ... I completely had that wrong when i worded the question (in fact I knew that, and should have said "granted permision" instead of "restricted"). Hindsight's 20/20. – davea0511 Jul 22 '16 at 5:32
  • No problem, I hope it cleared it up for you and others. – Dan Wooding Jul 22 '16 at 18:01
  • 1
    Your last sentence I think should be the header for trailhead on this subject: "profile allows what you can do, role allows what you can see". Completely awesome ... clears up a lot. Thanks! – davea0511 Jul 25 '16 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.