We have a group of users who are in a separate profile that we have hidden tabs from and setup basic security. However, we have found that some of them are "inquisitive" enough to use search to get to the Account, Contact, Project records and then drill down to some of the financial records that they are not supposed to access.
I know how to set field level security and also page layouts but I was hoping that I could simply deny access to the tab so that even if they searched for it or figured out how to enter the url that it would not display. I am also concerned that I have triggers, processes, flows, etc that might use these data fields. If I remove access to them for the profile, will the backend processes still work it they perform an action that triggers one of them?