1

I need some help on the implicit sharing to understand my misinterpretation of the documentation.

According to the doc.:

Sharing between accounts and child records
Access to child records — If you have access to a parent account, you have access to the associated child records. The account owner's role determines the level of access to child records.

I have an org where Account and Contact sharing is set to private. Sharing rule shares accounts with a group of users. Contact sharing is not set yet.

User A has "role A" that has contact access configured with the option:
"Users in this role cannot access contacts that they do not own that are associated with accounts that they do own"

User A owns "Account A" and some contacts. User M creates a contact under "Account A". User M has a different role (sibling role of role A).

As per my understanding User A should not see the contact created by M but he does.
User M can see all contacts on the account not only his own.
User Z in another role (child role of role A) can see all contacts on the account.
Non of the users have "view all data/contacts" permission.

Why what I see is different than what I assumed reading the documentation?

  • You would want to make sure it is actually Implicit Sharing that's the problem here. There's close to a dozen different ways a user can gain access to a record. If you're in Classic mode, go to the contact owned by "M" and click the Sharing button, then Expand the list. Salesforce will give you the reason for access in this table. – sfdcfox Mar 11 at 12:16
  • Thank you both for the comments. Sharing button page shows that all the mentioned users get access to the account because of the Account Sharing rule. However I thought if contact sharing is set to private users should not see them even if they have access to account.I'm puzzled what sharing setting takes precedence and in what situation would the role config visibility come useful? – user682217 Mar 11 at 15:42
  • Sharing is always "additive"; you can't restrict access to a record, but you can add access to a record. Therefore, make sure your sharing rules are also correct. – sfdcfox Mar 11 at 20:06
  • But my sharing on contact is private not controlled by parent. Why giving access to account grants access to contacts? – user682217 Mar 12 at 12:47
  • If you have a sharing rule, that's why. Account Sharing Rules can grant access to the account and associated contacts, cases, and opportunities. Check your sharing rule and make the appropriate adjustment. – sfdcfox Mar 13 at 3:55
1

I think there could be an issue with the sharing rule based on which Account record is shared to User M. If you create sharing rule and share those records based on role then User M or User Z will not see all the contacts on the Account.

I presume that, User Z has access to the Account by some sharing rule (which is not role based) and based on implicit sharing, he will see all the contacts even if he has not created those contacts.

Hope it clarifies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.