I need some help on the implicit sharing to understand my misinterpretation of the documentation.
According to the doc.:
Sharing between accounts and child records
Access to child records — If you have access to a parent account, you have access to the associated child records. The account owner's role determines the level of access to child records.
I have an org where Account and Contact sharing is set to private. Sharing rule shares accounts with a group of users. Contact sharing is not set yet.
User A has "role A" that has contact access configured with the option:
"Users in this role cannot access contacts that they do not own that are associated with accounts that they do own"
User A owns "Account A" and some contacts. User M creates a contact under "Account A". User M has a different role (sibling role of role A).
As per my understanding User A should not see the contact created by M but he does.
User M can see all contacts on the account not only his own.
User Z in another role (child role of role A) can see all contacts on the account.
Non of the users have "view all data/contacts" permission.
Why what I see is different than what I assumed reading the documentation?