We have some new sharing requirements in our org:

Our role structure is very simple

  Business Unit ABC
    ABC Midwest
    ABC Northeast
  Business Unit XYZ
    XYZ Midwest
    XYZ Northeast

Everyone should have read/write access to accounts.

Anyone within ABC should be able to have read/write access to any contact owned by someone else within ABC. Same with XYZ.

All of the contacts are associated with an account.

This works for the most part, except for when the accounts are of a specific record type (let's call it record type 123). If the account has a record type 123, then if the account is owned by ABC, they can see all contacts under ABC, even if it is owned by XYZ. Same for if an account is owned by XYZ. They can even edit the contact. They do get an insufficient access error when they try to delete it.

The sharing works fine for any other record type.

I have the roles set to No contact access even if they own the account.

Not sure what sharing settings there are specifically for record types. I did do a search of the entire codebase for __share and nothing for accounts or contacts came up.

Any ideas??

-- Edit

My contact sharing settings: OWD: Private, Grant access using hierarchies

Rule 1:
Criteria: Owner in Role and Internal Subordinates: ABC
Shared With: Owner in Role and Internal Subordinates: ABC

Rule 2:
Criteria: Owner in Role and Internal Subordinates: XYZ
Shared With: Owner in Role and Internal Subordinates: XYZ


1 Answer 1


Thank you @Rao!

It turns out the accounts with record type 123 all had manual sharing attached to them with access to contacts. This explains why the contacts were visible to those users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.