2

I'm unclear on what Granting access using hierarchies gets me in a scenario.

Suppose I have a private sharing model and on the Case object, I'm already Granting Access Using Hierarchies.

Given the Hierarchy below, what's the difference between sharing records owned by b0 with members of b0 vs. (keeping the Granting Access Using Hierarchies) and sharing records owned by b0's role and Internal Subordinates with b0? In both scenarios, won't b0 have read/write access to all records owned by b0,c0, and c1?

Setup:
  Private sharing model, where case has Grant Access Using Hierarchies checked.
  Role Hierarchy like the following:
    a0
    |
    |
    |_ b0
    |  |
    |  |______ c0
    |  |
    |  |______ c1
    |
    |_ b1
      |
      |______ c2
      |
      |______ c3
4

Grant Access Using Hierarchy (GAUH) transfers whatever permissions a subordinate has for a record to their managers in this role. For example, if a user in c0 can see a record in c2, perhaps by sharing rule or manual sharing, b0 can also automatically see that record as well. In addition, GAUH transfers the exact same level of permission the user has. This means if a user in c0 is an Owner, such that they have Full control (including delete permission), then the users in b0 will also enjoy that same permission.

With GAUH turned on, both a "Share b0 with b0" and "Share b0 and Subordinates with b0" will have the exact same effect. They already have manager-level access to their subordinates' data, and the sharing rule would only confer additional lateral read/edit permissions between users of b0 (but, notably, not Full control).

With GAUH turned off, "Share b0 with b0" would only share records laterally, and users in b0 could not see records in c0 or c1, while "Share b0 and Subordinates with b0" would confer permissions for all records owned by b0, c0, and c1, all at the same level, read or edit permission.

However, note that GAUH does something extra; it lets you see any record your subordinate can see, which may be more than they actually own. The primary purpose of this is to allow managers to do whatever their subordinates can do, presumably because the subordinate needs help, is on vacation, is being replaced, etc. In other words, GAUH is a manager-level feature, while sharing rules are strictly about sharing read and write permissions between departments.

1
  • Nice explanation . Even I was confused till now. +1 for question too. Sep 30 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.