7

Suppose i create a new object called "XXXX". Now profile called "AAAA" doesn't have read, create, edit permission on it.

Q1: What would happen if I create a record of object "XXX" and share it with user which has profile "AAAA" and give him "Edit" permission on the record? Would user be able to see the record or edit the record? please qualify your answer.

Q2: Can anybody explain in what order access on record or object is granted in terms of OWD, Sharing rule, Role and profile?

Q3: If i set OWD setting as Public Read/Edit on Object "XXXX" but profile "AAAA" don't have read, create and edit permission on Object "XXXX" then the user who owns profile "AAAA" would be able to see and edit the records of object "XXXX"?

Q4: What would happen if profile "AAAA" has only Read permission on Object "XXXX" then user who owns profile "AAAA" would be able to see and edit ALL the records of object "XXXX"?

Q5: In order to work out OWD setting, at least profile must have Read permission on that particular object?

Q6: The user who is higher role in hierarchy would get owner permission on the records created by user who are lower in the roles means he can edit and delete the record as well. Is that correct?

Improve this question

3 Answers 3

Reset to default
13

Imagine you have two users. Both are in the same profile, which allows them to Create, Edit object XYZ. But these two users are in different parts of the role hierarchy.

If User A Creates an XYZ, can user B edit it? The answer is only if the record is shared with him. If the Org Wide Default is Private then he will not even be able to see the record that User A has created (unless it is explicitly shared with him). He can still create his own XYZ records, and edit those. Likewise if the Org Wide Default is public read only, User B could see it, but not edit it despite what his profile allows. He can edit only his own records or those shared with him.

Sharing also works up the role hierarchy. So User A's boss can see the XYZ record that User A created. If his profile allows, he can edit it, but his profile may not.

You can think of the profile as "What can a user do with the XYZ object" and the sharing as "Which particular XYZ records can he or she do it with"

Does this help clarify?

EDIT--- Answering your additional questions

  1. If OWD is Public Read / Write but the profile does not have access to Read or to Edit then you cannot Read or Edit.

  2. If OWD is Public Read / Write on object XYZ and profile has Read permission but not Edit, then the user with that profile can only Read XYZ (all of them)

  3. If a user doesn't even have Read access to object XYZ then they cannot see any object XYZ regardless of the Org Wide Default.

  4. Not correct - the owner who is higher on the role hierarchy has sharing access to all the XYZ that his subordinates own. However, if the higher user has a profile which doesn't include read or edit then he cannot read or edit those records.

Improve this answer
4
  • It means profile gets priority on the OWD setting. If you set Public Read/Write on an object it doesn't mean all users can edit all the records. If profile has edit permission only then he can edit the records else not. doesn't matter OWD is public read/write. Am i right? Thanks for reply @Doug. I have added few more question. It would be great if you can answer then as well. Thanks in advance
    – Pramod Kumar
    Jul 16, 2013 at 13:44
  • I have added an edit with your new questions addressed
    – Doug B
    Jul 16, 2013 at 14:07
  • 1
    Also for the 4th point I want to add that for custom objects you can change the OWD setting Grant Access using hieracrchies. This is default selected but you can uncheck it. Thus after this the people higher in the hierarchy cannot access the records owned by subordinates
    – user3170
    Jul 17, 2013 at 2:09
  • That's a good point Mukul
    – Doug B
    Jul 17, 2013 at 9:50
2

No he wont be able to see the record because he does have the permission to access the object. The object itself is not available to this user who has profile AAAA.

Atleast he should have read permission on the object to see that object records.

if u wan to access the records without changing profile create the permission sets and assign it to the user then OWD will work out

Improve this answer
3
  • Thanks Doug. I have added few more question. It would be great if you can answer then as well. Thanks in advance
    – Pramod Kumar
    Jul 16, 2013 at 13:44
  • Sorry i wrote Doug rather than Mukul. It means profile gets priority on the OWD setting. If you set Public Read/Write on an object it doesn't mean all users can edit all the records. If profile has edit permission only then he can edit the records else not. doesn't matter OWD is public read/write. Am i right? Thanks in advance
    – Pramod Kumar
    Jul 16, 2013 at 13:53
  • yes you are write owd is meant for record sharing, profiles control the access of the object. I hope this clears you question
    – user3170
    Jul 17, 2013 at 1:45
1
  1. User can read and edit the record (But no way to create or delete)
  2. Profile AAAA who has this can see the record not to edit or delete or create
  3. No. Lower level cannot be edit or delete
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .