Hide Contact records while set to "Controlled By Parent" OWD

Question

Disclaimer: We are required to set the org-wide default for contacts to "Controlled By Parent" for reasons unrelated to our issue.

I am trying to determine if there is a way to hide some Contact records from being visible to all users, except for maybe SysAdmin. We originally had a plan to set Contacts org-wide default to "Private" and then set up the sharing rules based on criteria. However, because of the disclaimer above, we can't set any sharing rules at all at the Contact level, since all rules are set at the Account level. And we definitely don't want rules at the Account level, since our users should be able to see all the accounts, but not all of the contacts under the account.

Is there any other way we can hide these Contact records from being visible in the global search and on Account records without using Sharing Rules? I have thought about changing the Owner to a dummy user and building special permissions around it, but nothing has really come to fruition. I am also pretty flexible on what method we use to hide it, it doesn't necessarily have to be user-based or field-based, just whatever works best and is fairly quick to do.

Thanks in advance!

Answer 1

If you clear out the Account field, on the record the Contact will be removed from sharing entirely, and only users with View All Data will be able to see those contacts. They also won't appear in reports and list views unless the user owns those contacts, but administrators can still search for those contacts. This is the only way to keep Accounts at Read Only or higher and Contacts at Controlled By Parent.

Answer 2

If your Org-Wide Default for Accounts is Public Read or Read/Write, and your Org-Wide Default for Contacts is Controlled by Parent, your users all can see all of your Contacts (* that aren't private [no Account], as sfdcfox points out) provided they have permission to see that object at all.

The Salesforce permissions and visibility architecture is essentially always additive. You're intended to set the basic visibility rules to be maximally restrictive (such as Private OWD), and then add visibility through sharing rules, the role hierarchy, territories, and so forth. Additionally, the object- and field-level security mechanisms operate beneath this layer of record-level security, but those layers will not avail you here because what you want is record-level.

There is no method for taking away visibility that's granted or reducing the scope of granted visibility based upon criteria, other than completely reimplementing large portions of the user interface. Even that will not be a perfect solution, as you cannot change the behavior of Global Search.

Basically, you've settled on a set of requirements that are completely incompatible with one another.