I have two customer accounts lets say A & B. The OWD is Private. Now there are two managers (say xyz and jkl) with same role (say manager).
- xyz is owner of acc A
- jkl is owner of acc B.
We have a customer community portal user under account B and hence the role created by salesforce for that user is matching with account name. This role is under the role of Account owner's role i.e. under Manager role.
Ideally based on OWD, the person xyz should only see account A but he is able to see account B as well. When checked the accountShare record I observed that we have a portalImplicit share record created for this account B.
Why does xyz is able to see Account B?
I am suspecting that both the users have same role and since salesforce is sharing the account's read only access with portal user and hence eventually his role i.e. role B(created by Salesforce).
So role B has access to this Account. Hence its parent role also has access to this account which is Role: Manager. And since Role Manager has access to Account B, user A is able to see the Account B.
Is my assumption true?
If not why user xyz is able to See account B? How can we restrict him with Acc A only?