This might be somewhat of a stupid question, at least it feels like it should be a fairly easy solution but I've been banging my head against it for a couple of days now with no luck.

I'm trying to create a new role ("Legal") that only has access to records where I'm setting a hidden flag ("Enrolled in Legal")

The way I'm trying to handle it now, is by creating a sharing rule that shares all records that have the hidden flag set with the Legal role, and using a permission set to deny Legal users access to everything. As far as I understand, the sharing rule should override this permission set and allow Legal users to view the records that they need. This is not happening. Is there an easier way to set this up? Or is there something I'm missing here.


Salesforce permissioning and visibility is always additive. You can't subtract visibility using any tools in the security architecture.

These users must have CRUD and FLS to the object to be able to see any record. Then, the next layer is Sharing. If the Org-Wide Default is set to Public Read/Write or Public Read Only, you will need to change it to Private (and make the necessary sharing changes to provide access to your other users) so that the default for your new Role is to see no records other than those they own.

Then, your Sharing Rule will provide the additive access you're looking for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.