8

I have a strange behavior on my org. The user's profile have no "Delete" permissions for the custom object, only "Read / Create / Edit". So he can not delete any record from this object. But when i query the UserRecordAccess object with that user id and record id i am getting HasDeleteAccess = true.

SELECT RecordId, MaxAccessLevel, HasAllAccess, HasDeleteAccess 
FROM UserRecordAccess 
WHERE UserId = 'XXX'
AND RecordId = 'YYY'

What's the catch? The user profile have no permission sets assigned.

  • Just out of curiosity, is the user the record owner? – PepeFloyd Oct 15 '13 at 14:22
  • @PepeFloyd Yes, he is the owner of the record. – Sergej Utko Oct 15 '13 at 14:32
  • Does the user have Modify All Data? – Mike Chale Oct 15 '13 at 14:50
  • @MikeChale No, neither 'Modify All Data' nor 'View All Data' – Sergej Utko Oct 15 '13 at 14:51
10

Because the user is also the owner of the record, they are granted Full Access allowing them to view, edit, transfer, share, and delete the record.

Salesforce Documentation: "Record Ownership" - Understanding Sharing

| improve this answer | |
3

I'm curious, did you test out the 'owner' idea by changing owners and re-running UserRecordAccess to see if they still have delete access?

My understanding of UserRecordAccess is that it does check profile/permission set permissions which is why it's different than just using the Sharing button on the record to determine access. That's at least what I found while writing a blog posting on how to build a custom sharing button (http://www.salesforcehacker.com/2013/09/build-your-own-custom-sharing-button.html) but I'll be curious to see if delete is somehow handled different due to record ownership.

Have you run SOQL to determine whether there is another reason why the user has delete? For instance:

SELECT Assignee.Name, PermissionSet.Id, PermissionSet.isOwnedByProfile, PermissionSet.Profile.Name, PermissionSet.Label
FROM PermissionSetAssignment
WHERE PermissionSetId
IN (SELECT ParentId
    FROM ObjectPermissions
    WHERE SObjectType = 'Account' AND
    PermissionsDelete = true)

This would at least look across your user's profile and all permission sets to determine whether they have an object permission row that grants access.

| improve this answer | |
2

We have different types of OWD(Organization-Wide Sharing settings)

  1. Public
  2. Public Read Only
  3. Public Read/Write
  4. Public Read/Write/ Transfer.

So, in your case, the user have Public Read/Write access. Irrespective of OWD, since the user owns the record, he always have Read/Write/Delete/Transfer access.

NOTE: OWD determines the base level of access to the users for the RECORDS they do NOT own.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.