How does role-hierarchy work for user/manager role

Question

I would like to understand how role hierarchy works in SF as I have tried a few settings but somehow the role hierarchy is not respecting the record level access although the record level access is set to private.

A question related to how users are setup in SF, that am hoping one of you guys can help point in the right direction (need this in the context of a requirement I am building out)….

How do I meet the following requirement on any SF org? (a) I have user-1, user-2, Principal-1 & Principal-2 (b) User-1 reports to Principal-1 & User-2 reports into Principal-2 (c) So if User-1 creates a record, we want Principal-1 to automatically get access to that record. But Principal-2 should not have access to that record in theory how role hierarchy in private mode should work. Courtesy: Controlling Access Using Hierarchies (salesforce.com)

What I have tried and it did not work is below.

1. I created these 4 users in SF (Setup  Users). When doing this: a. I did not specify any value for the “Role” field on the User record b. I did specify the “Manager” value on the User record – setting Principal-1 as User-1’s manager, and Principal-2 as User-2’s manager c. RESULT: As User-1, I created a record. As Principal-1, I am not able to access this new record d. Based on the SF doc, it did indicate that the User’s Manager by itself does not have any impact on data visibility/access.

2. To overcome this limitation, I crated a role hierarchy – created a role “Role_USR” whose parent role in role hierarchy is “Role_PRIN”. I updated User-1/2’s user records to have their role as Role_USR, and the Principal-1/2’s user records now have their role as Role_PRIN

a. RESULT: As Principal-1, I am able to access the record created by User-1.

However, now Principal-2 user is also able to access this record.

What do we need to do here in the above use case where Principal-2 user is restricted to access the record created by user-1, who reports to principal-1.

Answer 1

the User’s Manager by itself does not have any impact on data visibility/access.

Correct.

User-1/2’s user records to have their role as Role_USR, and the Principal-1/2’s user records now have their role as Role_PRIN

a. RESULT: As Principal-1, I am able to access the record created by User-1. However, now Principal-2 user is also able to access this record.

This is the expected behavior (and you'll also find that Principal-1 can access records owned by User-2). This is because the Users and the Principals share roles, which means they also share role-based record access.

If you want visibility to roll up differently, you'll need more Roles. User 1 could have the Role "Service User", for example, and Principal 1 the Role "Service Manager", while User 2 has "Sales User" and Principal 2 "Sales Manager". Provided the "User" roles are under their corresponding "Manager" roles in the hierarchy, you'll get the visibility you're looking for - and so long as the "Manager" roles are siblings of each other, they won't be able to see each other's subordinates' records.

With the role hierarchy, remember that visibility works by roles, not by individual users. The reporting hierarchy of the personnel is irrelevant.