I have role hierarchy defined as follow,

 A    {CEO Role}
B C   {Principle Role}
D E   {Manager Role}

My OWD is Private, but still, - B can see E's Data - C can See D's Data.

How can I restrict that?


If you disable the Grant Access Using Hierarchies option, sharing with a role or territory and subordinates only share with the users directly associated with the role or territory selected. Users in roles or territories above them in the hierarchies will not gain access.Controlling Access Using Hierarchies


B is above E in the hierarchy, and C is above D. That's why they can see the records. It doesn't matter if E reports to C and D reports to B.

As an example, suppose you have Sales and Support teams, all of whom have the Sales Analyst or Support Analyst role. Both roles are parented under the Team Manager role. The Sales person with the Team Manager role can see records owned by both teams, as can the Support person. You'd need to have separate Sales Team Manager and Support Team Manager roles for the two Managers to separate their visibility, and parent their direct reports' roles under those separate roles.

This is one of the critical points to remember that the role hierarchy and its associated visibility effects do not follow the org reporting chart.

As Eduard points out, there are many other sharing tools that can provide visibility, such as View All / Modify All, sharing rules, and so forth.

  • As an additional check, make sure that user's B and C profile don't have the "Modify All" or "View All". These permissions do not respect OWD, Sharing Settings, Roles and Territories rules. – Eduard Jul 11 '18 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.