0

I have been struggling to understand how to implement the following requirement, would appreciate any useful tips.

How will you remove R/W access to Account records having record type "Partner", for a particular role ?

I was planning on doing the following -

  1. Set Account OWD to Private.
  2. Then add a Criteria-Based sharing rule that will share the records with the particular ROLE, when Account Record Type != 'Partner Account'.

Not sure if the above will work, can someone please validate or provide any better suggestions (if any).

Thanks,

Parikhit.

1 Answer 1

1

You need to do several things

  • OWD Private on Account (as you suggested)
  • Remove View All/Modify All on Account from any user's profile or permission set(s) that would access Accounts with recordtype = Partner
  • Add Criteria-based sharing rules for users in Roles that should be able to view Accounts with recordtype = Partner
  • Ensure that users who should not be able to see Accounts with recordtype = Partner do not have View All Data or Modify All Data

Basically, the principle is to remove permissions everywhere, then build back to users who need them

N.B. I'm assuming you aren't using Territories which add a different wrinkle

N.B. I'm assuming you aren't using Account queues as the members of such queues can see any record owned by that queue, regardless of recordtype

Note that if user has access to a Case, then even if normally they wouldn't have access to an Account, they will be able to see the Case's Account

3
  • Thanks for your quick reply, appreciate it. One question, how do we "Ensure that users who should not be able to see Accounts with recordtype = Partner do not have View All Data or Modify All Data" , aren't we already doing that with user's profiles & permission sets? Commented May 12, 2021 at 5:36
  • View All Data and Modify All Data are permissions on Profile and permission sets. They apply to every Sobject and appear in System Permissions. View All and Modify All permissions are individual object permissions.
    – cropredy
    Commented May 12, 2021 at 5:40
  • Yes I got, pardon me I didn't pay attention to the verbiage - I've read a bit about org-wide permissions, object-permissions & understood the difference. Thanks again for clearing that up! Commented May 12, 2021 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .