3

I was troubleshooting a scenario where a User was trying to create a Related Record (say Object A) on Opportunity which had a Master Detail relationship and was facing insufficient rights access issue.

Upon investigation I found the below configurations:

  1. Opportunity on Profile is set to Read
  2. Object A on Profile has CRUD access
  3. OWD for Opportunity is Private (Object A because of M-D is Controlled by Parent)
  4. Opportunity was shared with the User using a Sharing Rule with "Read" access only
  5. The way M-D relationship was set on Object A is as below (and honestly I didn't know it can have an impact): enter image description here

It seemed like because of the Sharing Rule where the User here had a "Read" access only on the Opportunities and because of the way the M-D relationship was set, they were not able to create the related record on Opportunity.

The time I extended the Sharing Rule to "Read/Write", it worked fine.

This is what leads to my question (I may be completely missing something very basic here):

What does "Read/Write" access on Sharing Rule really signify if an Object has only "Read" access on the Profile and that the record can actually never be edited?

Note that if the Sharing Setting definition on the M-D field was set to "Read" only, then this worked perfectly fine. In this case the master record didn't require to be shared as "Read/Write" necessarily. The whole point of sharing the master record as "Read/Write" really seems redundant here. And it just seems the overall issue is where while creating the detail record, the system validates the "access level" on Sharing Setting irrespective of if the Object itself is set to "Read" only on profile.

1

What does "Read/Write" access on Sharing Rule really signify if an Object has only "Read" access on the Profile and that the record can actually never be edited?

You'll want to read Sharing Considerations for most of the usual complications of sharing.

However, for the purpose of this question, it's important to make a distinction. A feature that requires a certain Sharing level of access to the record does not evaluate Profile Permissions regarding that feature. You can have Edit access to a record without having the Edit Object Profile Permission for that object.

If you have Edit access to an Opportunity, you can do all of the Edit-level features to that Opportunity, even if they can't edit the Opportunity itself because of Profile Permissions.

For example, the user can add Notes and Attachments, add Opportunity Team Members, Contact Roles, and so on, even if the Profile Permissions don't allow editing any Opportunity.

| improve this answer | |
  • 1
    Well in all the scenarios you have mentioned, you are not really making an Edit on the Opportunity itself (I mean from the way profile permissions are defined) and that you can achieve all this by just having a Read only access to it, right? What I think here is the distinction on how the M-D relationship has been set. And that's what is confusing me as why would "Write" be even applicable (I know you cannot have the profile level information while setting this up) in cases when it's not relevant. – Jayant Das Feb 12 at 22:22
  • @JayantDas It's applicable any time you want to have restricted access to the parent but not the children. In our org, Contacts are set to Controlled By Parent, because we want to make sure that users can only edit contacts for accounts they own (and managers, obviously). However, accounts themselves cannot be edited by normal users, as they are synced with external systems. So, they don't have Profile Permissions to edit Account records. I can easily see situations where you'd want similar control for custom objects. – sfdcfox Feb 12 at 23:12
  • Account/Contact is a special case I would say. However where I am stuck at is to understand and this is mostly one of those areas where Salesforce docs have no mention or clarity of it. If a Profile does not really allow a User to make any Edits on a master object, then why would a Sharing Rule based on a M-D relationship definition which says master should have a R/W access restrict child records to be created at the first place. I will keep this open to see if others have any different opinion. – Jayant Das Feb 12 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.