0

We have a user X, whose profile level access on an object is CRU. Now, this user is also part of a public group which provide read only access on the same object.

So, will the access provided by public group override the access provided by profile.

I.e. will user be able to edit records of the object,or update records of the object?

1

In order to edit a record, a user needs to have "Update Object" on their Profile, as well as "Edit" access or higher to a record. In other words, neither "override" the other in this scenario. The user would not be able to edit the record, because they lack one of the two requirements to do so. The Profile can override Sharing with "Modify All Data" or "Modify All Object" (where Object is the type in question), but Sharing can never override Profile permissions.

Note: Yes, the Sharing prevents editing in this case, but this is not technically an override. Both permissions and access are needed to edit the record.

Note 2: Permission Sets can increase Permissions for a user, but cannot take away Permissions. Similarly, a Sharing setting can add access to a record, but cannot "remove" access to a record. The most permissive Sharing access wins. This can be by Organization Wide Defaults, Role Hierarchy, Sharing Rules, Manual Sharing, Implicit Sharing, and Ownership.

| improve this answer | |
  • 1
    Also worth noting, in case Permission Sets come into the picture, that a Permission Set can only add extra permissions the profile doesn't have and cannot remove them. Similarly, with Sharing, more specific sharing (e.g. manual sharing) cannot remove sharing defined at a higher level (e.g. org-wide). – Phil W Apr 22 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.