I have two customer accounts lets say A & B. The OWD is Private. Now there are two managers (say xyz and jkl) with same role (say manager).

  • xyz is owner of acc A
  • jkl is owner of acc B.

We have a customer community portal user under account B and hence the role created by salesforce for that user is matching with account name. This role is under the role of Account owner's role i.e. under Manager role.

Ideally based on OWD, the person xyz should only see account A but he is able to see account B as well. When checked the accountShare record I observed that we have a portalImplicit share record created for this account B.

Why does xyz is able to see Account B?

I am suspecting that both the users have same role and since salesforce is sharing the account's read only access with portal user and hence eventually his role i.e. role B(created by Salesforce).

So role B has access to this Account. Hence its parent role also has access to this account which is Role: Manager. And since Role Manager has access to Account B, user A is able to see the Account B.

Is my assumption true?

If not why user xyz is able to See account B? How can we restrict him with Acc A only?

  • Did you find a solution ? I am facing the same problem.
    – David-IT
    Commented Nov 7, 2023 at 8:22

1 Answer 1


It is actually a combination of two things:

  1. Whenever you create a new portal user (partner or customer) (and a new role is created along with this) under a Partner or Customer Account, Salesforce will automatically create a sharing record with the reason "Associated Portal User or Role" (PortalImplicit). This is done in order to share the account (in your example Account B) with the role of the portal user.
  2. Grant Access Using Hierarchies is active for the Account object and cannot be changed. Therefore the access of the Portal User to the Account (B) is shared with all users above this user in the role hierarchy. As in your example the user jkl owns the account (B), the access granted for the portal user is shared with the role of user jkl. In your example it is the role "Manager". -> As the user xyz also has the role "Manager" he will get the same read only access to the Account B, like the Portal User has.

So it is important to know that data owned by portal user will always be visible to user who share the same role as the owner of the Partner/Customer account, as long as the user has the necessary access to the object and it is a standard object where you cannot change the sharing along the hierarchy.

Hope this explanation helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .