Sharing access of Case Comments

Question

In my org, Sharing settings of Case object is "Public Read Only". So only case owner or those users who are part of Case team can edit the case record.

All the users have Read, Create, Edit access to the Case object at the profile level.

Now, when an user try to edit the case which other user's have ownership and he is not part of case team, then it is showing "Insufficient Privileges". That is perfect!

But that user can add the case comments in that case.

My question is how sharing of Case Comment works? Is that Public Read-Write? I think it should inherit the sharing from Case.

Answer 1

Permissions do not carry over to cases like you would think. There is an existing idea around this here:

https://success.salesforce.com/ideaView?id=08730000000BpYo

Currently, administrators can assign granular permissions to cases -- read, create, edit and delete. These permissions do not, however, carry over to case comments. A user with read-only access to a case can still add comments, public or private, which can trigger an email to the customer and disrupt support processes. The only way to prevent a user from adding a comment or toggling the private/public flag is to remove all access to view the case. I propose that either a) case comments inheret the permissions from cases, or b) have their own set of permissions.

The reason the comments are public are many I would think, especially when you start thinking about community, email to salesforce, channels where login not required or identification of commenter cannot be determined, etc, etc, etc. If they were limited it could break a lot of things.