How should I share a summary-level view of opportunities without sharing their activities, emails & files?

Question

I have an org containing several business subsidies working on opportunities.

These opportunities may have sensitive data attached to them in files, emails, calls, etc.

Users in each subsidy should be able to see and collaborate on their own subsidy’s opportunities and see the sensitive data attached to those opportunities.

For other subsidies' opportunities, they need to see the "summary" (c. 20 fields), but they must not have access to the activities or files under other subsidies' opportunities.

The global CEO must be able to report on the pipeline of opportunities globally, but he too should not be able to see the emails, files etc. under these records.

I see several options for this:

1. Opportunities private OWD; flat role hierarchy; use a Lightning component without sharing to expose opportunity summaries on parent accounts; create a dashboard containing non-sensitive opportunities data, put in a dashboard that runs as an admin user, and share this with the CEO
2. Automatically create a child record under each opportunity; attach sensitive emails / files to this record instead of the opportunity itself; only share this record with people within the same group and deselect the option to share up the role hierarchy
3. For each opportunity record, automatically create a custom "Opportunity Summary" record that pulls in the c. 20 non-sensitive fields from the Opportunity. Share the opportunity record only with the owning group, and share the "Opportunity Summary" with everyone else. Keep this record updated with any changes to the original record

Option #1 seems the simplest, but has big limitations with regards to things like reporting (e.g. the CEO being unable to directly view the global report, outside the context of the dashboard, which prevents him customising it or exporting to CSV)

Option #3 addresses this, but duplicates every opportunity and could cause confusion (users getting mixed up between opportunities and opportunity summary records)

What do you think of these options? Is there a better approach I'm missing?

Answer 1

I think you can do this by adding an Action on the opportunity page layout.. "Subsidy Opportunities". Using LWC in combination with an aura component you can build an Action. This will give you a lot flexibility in terms of visibility and access.

If you don't have a Constant class you can create one as a kind of helper utility and add the profiles to that Constant class.

    public without sharing class MyConstants {

    // Profiles
    public static final String SYS_ADMIN_PROFILE = 'System Administrator';
    public static final String STANDARD_USER = 'Standard';
    public static final String CEO_PROFILE = 'CEO';
    public static final String SALES_PROFILE = 'Sales User';

}

The all idea is that you can call this class in your LWC to check who is executing the action and based on that allow or not access to a more complex matrix set of rules. The with sharing is utilized to reinforce security, all visibility or behaviors allow to the user will be controlled buy the Set you can see below:

public with sharing class SubsidyOpportunities {

private static Set <String> userProfiles = new Set <String>{
        MyConstants.SYS_ADMIN_PROFILE,
        MyConstants.STANDARD_USER,
        MyConstants.CEO_PROFILE, 
        MyConstants.SALES_PROFILE
     };

}

On the class you use for the LWC you can just add this Set that latter you can use for controlling access over fields, sections, visibility...

In the methods you will be working on you can just:

Profile profile = [
                    SELECT Id, Name
                    FROM Profile
                    WHERE Id = :UserInfo.getProfileId()
            ];

This is an idea on how to control who is the current user, and based on that you can build logic around it.

On the LWC you can build a simple layout that will expose all those opportunities with some type of pagination. On the bottom of that page you can have a section, initially hidden, that will show the 20 fields if you click on any of the opportunities on a data table expose on the HTML that is part of your LWC. You can add even more sections like the emails related to that record depending the profile viewing the page.

There is a bit more than this but this is a way to perhaps offer a clean solution and user friendly experience. They just click on a button, they get a modal with a pagination system that is adding all the correct opportunities, and finally if the click in any record you will see a section showing the fields related to that particular record (opportunity)...