If the OWD of a custom object is Private and Grant Access Using Hierarchy is enabled, then whether the user in the higher hierarchy always has the edit, read, delete access on the records which is owned by the user in the lower hierarchy? Can we just restrict it to read access to the users in the higher hierarchy? How does this access work for users in the higher hierarchy?
2 Answers
Role hierarchy works in tandem with Profiles.
Let says a role sales manager reports to VP.
Object permission of Sales Manager profile assigned to people in Sales Manager role is CRUD and for VP is Read, then because of the hierarchy setup, VP role users will have access to all records that are visible to people in Sales manager role, but the object permissions will define what a VP can do with those. If the VP's profile does not have Edit permissions, he won't be able to edit the records, regardless of sharing setup.
I would like to highlight some points regarding Managed Sharing - Role Hierarchy:
- The Role Hierarchy enables users above another user in the hierarchy to have the same level of access to records owned by or shared with users below. Consequently, users above a record owner in the role hierarchy are also implicitly granted Full Access to the record.
Here, Full Access implies ability to view, edit, transfer, share, and deleted the record.
- Also, it is true that this Managed Sharing - Role Hierarchy works in tandem with the OLS and FLS permissions. It means that if users in higher hierarchy does not have Update or Delete OLS - Then the user would not be able to update or delete the record owned by users in subordinate roles.
So, if you want to provide the users in higher hierarchy only read access to records owned by their subordinates. Then, restrict it by removing Update and Delete OLS from their profile/permission set.
