I've a use case where Users having a PermissionSetAssignment X should not be allowed to be made owner of a custom object record by another users. I'm able to do this using a trigger but I've to make it work using configuration. How can I achieve this using validation rule or any other config concept (The Lookup field is based on User and Group and lookup filters can't be used here).

1 Answer 1


Validation rules can reference custom permissions and custom permissions can be assigned to permission sets

so, a rule could look like


where Owner_Change_Restricted is a custom permission assigned to a permission set possessed by some users

Personally, I prefer to make my permissions named something positive, so the validation rule would be:


and custom permission Owner_Change_Enabled assigned to permission sets for users that can change ownership.

  • Let's suppose we have a user A with Permission Set X and another user B with permission set Y. If user A tries to make user B and owner of a record, he shouldn't be able to do it. Using $Permission in validation rule will reference custom permission of User A and I need to verify Permission of User B when logged in with User A. Commented Dec 2, 2020 at 5:40
  • Ah, I misunderstood your requirement. To do declaratively, use a before save Flow that does the check and if not valid, sets a checkbox on the object Is_Invalid_Change__c that a Validation Rule can then test and render an appropriate error message. Flow can query the target user and relevant permissionsetassignment object.
    – cropredy
    Commented Dec 2, 2020 at 6:55
  • Creating a new field would require design changes and approval. Seems that going through apex is the only way here not to break the existing design and functionalities. Commented Dec 2, 2020 at 9:21
  • Best I can come up with for your request for a declarative solution:-)
    – cropredy
    Commented Dec 2, 2020 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .