0

I have a situation where the user is able to create a case record of record type RecordTypeA using Salesforce flows as a system user. The requirements are

  1. The user shouldn't edit any of the fields of that newly created case with RecordTypeA when viewing the case details. Those fields should be editable only by the admins.
  2. The same user should have edit access to RecordTypeB of the same object.

What I tried so far, but still not getting the expected result -

  1. Changed the Org wide defaults of the Case object to private

  2. Created two Public groups - 1. Sales agents 2. Admins

  3. Created three sharing rules based off criteria -

    1. If the user views a case of RecordTypeA, make it read/write and assign it to Public Group - Admins.
    2. If the user views a case of RecordTypeA, make it read only and assign it to Public Group - Sales Agents
    3. If the user views a case if RecordTypeB, make it read/write and assign it to Public Group - Sales Agents
4
  • 1
    so, criteria-based sharing rules apply only to record viz, not field-access
    – cropredy
    May 17, 2021 at 19:09
  • @cropredy any idea how I could make the above situation work
    – sumchans
    May 17, 2021 at 19:11
  • 1
    you can always use different page layouts by recordtype/profile until such time as SFDC rolls out dynamic forms for standard objects (LEX); see also workaround
    – cropredy
    May 17, 2021 at 19:27
  • Thanks @cropredy
    – sumchans
    May 17, 2021 at 21:10

1 Answer 1

1

You have several things at play here:

Sharing Settings

  • OWD and Criteria-based sharing rules determine record viz and basic r/w but otherwise say nothing about any specific fields available for editing
  • Record ownership (or if owned by a queue, queue members) will be able to edit the record, regardless of recordtype
  • Permission Set/Profile can extend edit access regardless of recordtype through presence of Case object Modify All permission
  • Case Team membership can also override edit permissions based on recordtype
  • Apex managed sharing " "
  • Permission Set/Profile permission of Modify All Data trumps everything

Field Level security

Edit access to a particular field when presented through the standard UI (or client component that respects FLS) is determined by the user's profile/permission set - not by sharing rules

Strategies

  • For custom objects, in LEX, you can use dynamic forms to make fields viz; for standard objects like Case, this awaits a post V51 SFDC release
  • You can always use the matrix of recordtype v profile to assign different page layouts (and hence different field vz/editability based on page layout). This feature has been around since the 2000's and can overproliferate profiles when taken to an extreme
  • You can also use Validation rules that test for the conditions you care about and say "xxx may not be changed" and users self-learn over time

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.