This might be somewhat of a stupid question, at least it feels like it should be a fairly easy solution but I've been banging my head against it for a couple of days now with no luck.
I'm trying to create a new role ("Legal") that only has access to records where I'm setting a hidden flag ("Enrolled in Legal")
The way I'm trying to handle it now, is by creating a sharing rule that shares all records that have the hidden flag set with the Legal role, and using a permission set to deny Legal users access to everything. As far as I understand, the sharing rule should override this permission set and allow Legal users to view the records that they need. This is not happening. Is there an easier way to set this up? Or is there something I'm missing here.