I have the a role hierarchy like this:

  manager                        suboridinate
  profiles                         profiles

                    ----------- ChildRole1.1
                    ----------- ChildRole1.2

                    ----------- ChildRole2.1
ParentRole2---------|---------- ChildRole2.2
                    ----------- ChildRole2.3

Suppose an Individual record IndiRec1 was created by user with role ChildRole1.1. Now this IndiRec1 needs to visible only to users with role ChildRole1.1 (also editable for all users with the record's owner role), ChildRole1.2 and ParentRole1, because these 3 form a unit. This visibility part I have achieved it using sharing settings and lightning component.

I have a situation where when a user with Admin profile checks Forget This Individual on this IndiRec1, this record should be hidden for all profiles except for Admin. When Admin unchecks the Forget This Individual it should be visible to it's original unit.

I can think of only Apex share, which still isn't good enough:

  1. Make Individual object Private in sharing settings.
  2. Every time an individual is created, I need to create a new individual share object, indiShareRec, add the recordId to the indiShareRec's ParentId.
  3. Specify access level. For ChildRole1.2 it is Read and for all users with Role ChildRole1.1 Edit.
  4. Add user or group id's. I have a public group called ParentRole1 containing ChileRole1.1 and ChileRole1.2.
  5. Insert this indiShareRec.

Step 3 and 4 are a problem. Because I need to give Read access to ChildRole1.2 where as I need to give Edit access to users with role ChildRole1.1. How can I do this? As far as I know indiShareRec.userOrGroupId takes a single public group id.

Any suggestions? Is it even possible?

  • Can you simply change the owner to a user with no role when the individual is forgotten?
    – David Reed
    Aug 28, 2020 at 15:37
  • If I change to a User with no role, when the Admin unchecks the Forget This Individual, this record should be visible to it's original unit i.e., all users with the Role of the original owner and his siblings(who can only read). How can I maintain this relationship?
    – nSv23
    Aug 28, 2020 at 15:43
  • Store the original owner Id in a text field and set it back?
    – David Reed
    Aug 28, 2020 at 15:47
  • Yes, seems to be the only way. I will try it. Thanks for the suggestion.
    – nSv23
    Aug 28, 2020 at 15:49

1 Answer 1


Summarizing my comments as an answer:

One way to achieve this, without knowing more about the sharing setup that you've currently implemented, is to pull Forgotten records out of the role hierarchy by assigning them to some user as owner who does not have a role or who sits at the top of the role hierarchy.

You can store the original owner id in a text field or a separate lookup. Then, when you unforget a record, you can restore the original owner so that the original sharing re-takes effect.

Note that at large data volume you may need to think about ownership skew and consider round-robining records across multiple role-less users when forgotten.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .