Managed package roles

Question

We have a managed package with two permission sets - Admin & Manager. The admin permission set has access to all objects and can perform any action within the app.

For the manager permission set, we want to restrict access in terms of what they can do and see in the app. For eg. users with Manager permission set can create objects in the app but they should be able to view & edit only their own objects. The other usecase is that they can edit their own objects but can view other users objects as well.

I understand that I can give CRUD/FLS access to these objects using permission sets, but how do I control record level access for these objects for different users? Can this be achieved with a permission set?

Answer 1

Permission Sets don't have the ability to control sharing setting this way, so there's no way to package this, either. Administrators would be responsible for configuring the sharing settings beyond the default sharing settings for the object(s) involved. You would want to set the Default Sharing Settings to Private, then administrators can create additional rules as necessary after installation.

Answer 2

I'd suggest taking a look at Sharing Rules - it's not clear from your post if you are developing the managed package and want to ship rules as part of this package or just wanting to set it up on your org.