I have a requirement where there are federal and commercial Orders. Federal Orders should only be shared with Federally certified users and commercial users should not see these orders. Federal users could be in any role within the organization. I thought of a Federal public group and sharing rules but the sharing roles up the role hierarchy to users above a user in the public group giving them access even if they are not in the federal public group. I cannot disable grant access through role hierarchy as this touches standard objects. I also do not want to create separate strands of the role hierarchy for federal and commercial users as that will distort management reporting and make the hierarchy very large. Final option i am considering is a Modify All Permission Set on the selected objects for Federal users. Anyone have any better ideas on how to achieve this? Help much appreciated.
Firstly, the "Grant Access using Role hierarchies" can be set individually for custom objects.For standard objects, it cannot be controlled or turned off.So, i think the public group approach will work for you if you disable "Grant Access using role hierarchy" option for that custom object.