We have two companies with their seperate roles hierarchy under same organisation. The hierarchy is same for both companies
CompanyA Manager - CompanyA Processor - .. CompanyB Manager - CompanyB Processor - ..
Under no scenario these two companies should be able to see other's cases or accounts. The case and accounts data is being fetched by 3rd party systems through middleware and because of some of data entry messup, external id for accounts is sometimes the same for both companies.
I'll get to the specific problem, we have such scenarios where Case owned by CompanyA Processor has an account associated that is owned by CompanyB Processor. This is a user data entry mess up and for now we don't have to fix it, only restrict the access.
This is how it should be restricted:
1- CompanyA Case owner should not be able to see CompanyB account, which is somehow is tagged with CompanyA's Case
2- CompanyB Account owner should not be able to see CompanyA Case, which is somehow associated with CompanyB account.
and vice versa
I can achieve the second restriction by editing the processor role and select the Case option where user should not be able to see the cases they do not own.
Now I want the reverse, I want to restrict Processor's access to accounts they do not own that somehow is tagged to the Cases they do own. But currently, Case owner can open and edit accounts tagged even if they do not own it.
Note: Accounts & Cases OWD are set to Private. I have not given any permission to processors to Read or write other company processor's accounts or cases in sharing rule.