Does anyone have any advice on my thoughts that we not use (barely) any Roles, and share records solely using Sharing Rules?
Originally we looked at having each Division of the company in a Role, isolating access to the records for each Division. But some employees will be multi-Division (and some will be Corporate, all records). Sharing Rules are controlling "everything" at this point (and those it does not, don't require control, so Role is irrelevant).
I understand the implications overall (but also assume I need other eyes looking at this). I'd like to DENY access TOTALLY to the key Objects and then ALLOW using Group Membership and Sharing, in the case of this multi-division company, and given restraints I have due to the use of Rootstock.
I already have a Primary Division picklist, and then "visibility" checkbgoxes for other Divisions, on the User record, and those create/remove Group Membership automatically - control to access is literally a group of fields on the User now.
Current Roles are as followed (would likely add an "Executive" to this):
I could see having THREE SIMPLE LINEAR Roles, such as:
- Top: "The Entire Company"
- Level 2: "Corporate Office"
- Level 3: "Divisions"
...and that's it.
Originally, Level 3 would have been one Role for each Division, but Sharing is TOTALLY controlling that now.
We're using Financial Force (and ZenKraft and Rootstock, but those will be Share-controlled as needed).
Advice? Should I at least put the Divisions separate at Level 3 as originally planned as a "safety net"?