0

I have this situation.

In our sharing settings we have Account Sharing Rules that says something like:

Rule 01: If an account record has a value 'ABC' in field01, then ONLY users with Role, 'RoleABC' can see them.

Rule 02: If an account record has a value 'DEF' in field01, then ONLY users with Role, 'RoleDEF' can see them.

However, user with RoleABC tried to search the Account Phone Number (ex. 12345) and he got two Accounts that has 'ABC' and 'DEF' values in their field01 respectively. (Note: Both Accounts have the same phone numbers)

Ex: Search Results for Phone Number - 12345

Acct01: field01 - ABC Phone Number - 12345

Acct02: field01 - DEF Phone Number - 12345

Based on the Sharing Rules, User of RoleDEF should not see Acct01, but in the actual search result, he saw both Acct01 and Acct02.

Can anyone give me some idea why this is happening?

We really think that the fix for this is to recalculate the Sharing Rules for Account since Rule02 is a new rule. However, since this is in our Production, I'm kind of hesitant to do the recalculation until I've exhausted all other explanations.

Thanks.

  • 1
    It's important to remember that sharing rules are always grants of access, and never take away other access. The user may have other reasons to access Acct01, like the role hierarchy or an implicit share based on owning a Contact or Case associated with it. If you inspect the Sharing window for the Account, what do you see? – David Reed Aug 22 '18 at 11:54
  • If you have created that rule newly or deployed that in production, then without performing recalculation, existing record visibility will not get changed. I am assuming OWD of Account is Private. – Santanu Boral Aug 22 '18 at 11:59
  • May be user is owner of the DEF record or record is shared with him in other way like using Apex sharing, Role hierarchy or user have view all permission – Chandra Kiran Aug 22 '18 at 12:00
  • @DavidReed Thank you so much for that one. That is the correct solution. – Atoc Aug 23 '18 at 7:40
0

It's important to remember that sharing rules are always grants of access, and never take away other access. For that reason, I don't believe that recalculating sharing rules will have any effect unless you also changed some rule providing access to be narrower.

The user likely has other reasons to access Acct01, like the role hierarchy or an implicit share based on owning a Contact or Case associated with it.

You can review these visibility sources by inspecting the Sharing window for the Account.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.