I am building an application for Leave request. i have objects like Employee data, rule plan setup and Request leave.As system administrator I have access to all these records, tabs and data.

For example, I have a record with employee john smith in my employee data setup. and I have user profile(applicationname_user) and 3 permission set as employee,HR admin and manager where specific access to tab is given and also added roles in heirarchy. These 3 roles have issues in seeing specific tabs How to restrict john to see his only record when he login as an employee in read mode?


To help you remember which controls what, remember: Roles control Records.

This depends on Ownership and Role Hierarchy.

Setup > Administer > Manage Users > Roles

This is just an organisation tree.

With respect to record access, you can start with Org Wide Defaults.

Setup > Administer > Security Controls > Sharing Settings

If you only want John to be able to access the record, he would need to be the Owner and have the Object's Default Internal Access and Default External Access set to Private. If his manager, manager's manager, manager's manager's manager should access the record, you'll want to tick Grant Access Using Hierarchies.

Profiles and Permission Sets can only really give 2 options that "override this":

  • View All Data - Blanket Read Access to everyone with this Profile/Sermission set
  • Modify All Data - Blanket Everything Access to everyone with this Profile/Permission Set

I'd strongly suggest reading up on:

Not the answer you're looking for? Browse other questions tagged or ask your own question.