1

I thought I had all the right permissions in place, but apparently not: one particular user has edited a certain record, which should not have been possible.

When I look at the sharing of this record (via the sharing button, expand all), the user is not listed there. The default sharing for the object is 'Public read-only'. So the first strange thing is: why aren't all users shown here, since everyone should be able to see the record (and they are).

The only users listed on the sharing page are the owner of the record, the sysadmins and the manager of the owner. They all have full access.

I have checked that other users are not able to edit the record. Where can I find the info that tells me which setting in Salesforce has enabled the user to edit the record?

I have checked the profile, the permission sets, global groups, ... 'Who sees what' continues to be a challenge in Salesforce.

  • Does the user have Modify All Data permission? – David Reed Jan 18 '18 at 16:29
  • That user might be higher in the role hierarchy or according to @DavidReed have modify all data permission on its profile. – Abhishek Daware Jan 18 '18 at 17:46
  • if the record is the child in a master detail - that also would inherit the rules of the parent - so if he is shared the parent - he would be able to access any and all children to that parent record. – Ronnie Jan 19 '18 at 3:06
  • The user is on the same level in the role hierarchy. And as I stated in the question, the user is not listed in the sharing of the record. – Sander de Jong Jan 22 '18 at 7:29
0

Since OWD is Public Read Only so, only owner, managers of the owner and the person with Modify All Data permission like SysAdmin can edit this record now.

If other users need to edit this record then, you need to take following path to provide access to other users:

  1. Sharing rule (either ownership or criteria based)
  2. Manual sharing
  3. Force.com or Apex managed sharing.

In case of Account, Opportunity or Cases use Team to share the record.

  • No sharing rule, no manual sharing, no Apex managed sharing. Maybe the person has Modify All Data permission, but so far I have not been able to find out how the person has obtained that permission. Not via his profile and not via the permission sets. – Sander de Jong Jan 22 '18 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.