I am struggling to set up an account-sharing security environment for a Salesforce instance.

The company has two groups of employees who share accounts and contacts intra-group, but not inter-group.

Accounts and contacts are both set as private.

Two sharing rules each in both accounts and contacts say that if record owner is in GroupA, users in GroupA have access, if owner in GroupB, users in GroupB have access.

We have some accounts that both groups need to access. They are owned by a user who is in both Public Groups, so all users can see those records.

We want all related records to the shared accounts to be still private to the individual groups.
In other words, if a GroupA user adds a contact linked to the shared account, only GroupA users should be able to see it. Same with GroupB. We would like that logic to also apply to attachments, notes, activities, posts, emails, etc.

All works properly except that all attachments to the shared accounts are visible to both groups.

Focusing on just contacts for the moment, I created a linked contact owned by a user in GroupA. When I log in as a user in GroupB, I can see that contact.

I'm not sure why that is the case. Sharing rules should allow me to see the account, but should NOT let me see the contact. Can anyone tell me why I can?

Reiterating that contact sharing is Private, not Controlled By Parent.

Thanks for any help that you can give on setting this up properly.

Bryan Hunt

Browse other questions tagged or ask your own question.