2

We have a group of users who are in a separate profile that we have hidden tabs from and setup basic security. However, we have found that some of them are "inquisitive" enough to use search to get to the Account, Contact, Project records and then drill down to some of the financial records that they are not supposed to access.

I know how to set field level security and also page layouts but I was hoping that I could simply deny access to the tab so that even if they searched for it or figured out how to enter the url that it would not display. I am also concerned that I have triggers, processes, flows, etc that might use these data fields. If I remove access to them for the profile, will the backend processes still work it they perform an action that triggers one of them?

4

It's not enough to remove access to the tab, or, strictly speaking, field level security. You need to remove access to the object itself (turn off "Read Object", e.g. "Read Accounts"). Triggers are not generally affected by the sharing model or profile permissions, so even if the user can't view/edit a given record or object, it won't stop the trigger from running. This is known as "system context." The exception to this are flows; flows run in "user context," so if they can't see the records, they may get flow errors. You might need to resort to using Workflow Rules or Visualforce pages instead of flows.


If you need to restrict access just to records the user should be able to see, you need to modify your Organization Wide Defaults and possibly your Sharing Rules. Only by correctly configuring your security settings can you limit access. Since you've tagged this as a Community question, this probably means you need to set the External Sharing Model to Private, and then configure additional access rules as necessary.

  • That is not possible. We have a large number of flows that process throughout the system. In testing this, the resource can search for the customer's name and all of the assignments and expense reports for that customer even if the record is not for the logged in user. We have list views for the affiliates that only show their own entries, but how do I make search respect that as well? – Jerry Welliver Jun 13 '18 at 14:48
  • @JerryWelliver It sounds like you need to adjust your sharing model. I've updated this answer to reflect that. – sfdcfox Jun 13 '18 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.