I am working with an object called Scope Library. I want users to have read access by default. I want the group Presales to have read, edit and create access on the object.

To give users read only acces I set the org wide defaults as in this picture below:

enter image description here

To give Users in the Presales group edit and create access, I created a sharing rule on the Scope Library object. The criteria is Role and internal subordinates for the CEO role. This is so that everyone at or below the CEO level will be considered in the criteria (ie. Everyone at the company). Then, in the Share with field I select the Presales group. The picture of this sharing rule is below:

enter image description here

Finally, everyone in the Presales group will have the Standard user profile. The object settings for the Scope Library object in this profile is below (the 2nd column is 'object permissions'):

enter image description here

I would expect that when I login as a user who belongs in the Presales group, I would have edit and create access but I do not. Does anyone know what I'm missing? Thanks and if you need any additional info please let me know

2 Answers 2


The "CRUD" (Create, Read, Update, and Delete) permissions at the profile level allow users to create, read, update, and delete records at all. Without those permissions, it doesn't matter what sharing says.

As an analogy, imagine a secure building and you have a security badge. Your badge will allow you to enter the building, and certain rooms inside the building.

In this analogy, the badge is a profile, the building is an object, and certain rooms are specific records. If your badge doesn't allow you in the building, it doesn't matter what rooms you have access to. Similarly, if you don't have access to an object permission, it doesn't matter what sharing says you can do with that record.

Make sure you give your users the C, R, and U permissions for the object. Sharing will prevent them from editing records they should not.

  • Thanks for the analogy, that makes sense. I tried giving the standard profile CRUD access, but that gave everyone who has the standard profile edit and create access. But I only wanted people in the Presales group to have create and edit access.
    – tom_12321
    Dec 18, 2018 at 16:37
  • 1
    @tom_12321 you need a separate profile or use a permission set. I see your comment on the other answer, and the answer to that is no, you can't have a trigger on a group/groupmember, so you'll need to do something else. One possible solution could be a user trigger that adds/removes them to the group when the profile changes. This is how we implemented group management in some of our code.
    – sfdcfox
    Dec 18, 2018 at 17:12
  • thanks for your help, we ended up going with using permission sets, which unfortunately means we will have to manually assign them to users as needed.
    – tom_12321
    Dec 18, 2018 at 18:28

Sharing is not used for giving access to read/edit object but specific record.

In your case you probably should create permission set for people that would be able Create, Edit, Delete Libraries and assign it to them. Then create sharing rule that will permit the group to Read/Edit records (which you already have).

  • Thanks for the feedback. We thought about using permission sets but then we would have to manually assign them and remove them as Users entered and were removed from the Presales group. Is there any way to either automate that (maybe by using a trigger) or grant this access without using permission sets? Thank you!
    – tom_12321
    Dec 18, 2018 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .