Manual Sharing/Opportunity team exposes other related data

Question

We have two separate teams(A,B) which are not supposed to view each other's data. Specially account details, activities, contacts and opportunities.

But sometimes user A1 has to share opportunity with user B1 if there is a business need for that exception. The way we accomplish this by manually sharing opportunity or making user B1 opportunity team member of opportunity owned by A1. But the problem is that it exposes other data as well. Like account details, activities and related custom records. Is there any way we can prevent visibility on related records when we add a user as opportunity team member or manually share opportunity?

Answer 1

You have several different sharing questions here.

account details

This behavior is called Implicit Sharing.

Access to a parent account—If you have access to an account’s child record, you have implicit Read Only access to that account.

Here, "child record" means

opportunities, cases, and contacts

You cannot disable implicit sharing at the level of record-level visibility. You can, of course, deny Field-Level Security at the Account level for sensitive fields, but this will apply across all records.

activities

There are some complexities to activities access. Note however the salient point

You can view an activity if: ... You have at least read access to the record to which the activity is related

See also this Idea on hoped-for changes to the Activity sharing model.

related custom record

The results you'll see will depend on whether or not these records have their sharing settings Controlled by Parent (i.e., a master-detail relationship). Detail objects can't have separate sharing and visibility from their parents, so you won't be able to adjust this without denying access to the entire child object.

So, to summarize, the behavior you're seeing is the expected behavior of the Salesforce sharing model, and in large part can't be changed. The elements that can be changed, like custom object behavior, will require careful review to determine whether the alterations to your org's sharing settings that would be necessary meet your other requirements or have any impact on your existing codebase.