1

Does anyone have any advice on my thoughts that we not use (barely) any Roles, and share records solely using Sharing Rules?

Originally we looked at having each Division of the company in a Role, isolating access to the records for each Division. But some employees will be multi-Division (and some will be Corporate, all records). Sharing Rules are controlling "everything" at this point (and those it does not, don't require control, so Role is irrelevant).

I understand the implications overall (but also assume I need other eyes looking at this). I'd like to DENY access TOTALLY to the key Objects and then ALLOW using Group Membership and Sharing, in the case of this multi-division company, and given restraints I have due to the use of Rootstock.

I already have a Primary Division picklist, and then "visibility" checkbgoxes for other Divisions, on the User record, and those create/remove Group Membership automatically - control to access is literally a group of fields on the User now.

User Division control fields

Current Roles are as followed (would likely add an "Executive" to this):

enter image description here

I could see having THREE SIMPLE LINEAR Roles, such as:

  • Top: "The Entire Company"
  • Level 2: "Corporate Office"
  • Level 3: "Divisions"

...and that's it.

Originally, Level 3 would have been one Role for each Division, but Sharing is TOTALLY controlling that now.

We're using Financial Force (and ZenKraft and Rootstock, but those will be Share-controlled as needed).

Advice? Should I at least put the Divisions separate at Level 3 as originally planned as a "safety net"?

Improve this question

1 Answer 1

Reset to default
2

If you don't use any role based sharing specific to each of your divisions, you're likely to run into issues with visibility of records in terms of users in roles above not being able to see the records of those below them. It could also potentially impact approval processes you may have in place that are role based. There may be things that one division doesn't need to see that's only important to the other division. I'd only share those on a need to know basis using groups.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .