I and my colleague having difficulty in deciding which option of below is better. Please help.

Requirement is, for an object all internal users should have read access to all records and users with particular permset should have Create/Edit access to all records.

Option1: OWD Public Read Only. Permset with Modify All for that object and Create/Edit Object/Field access

Option2: OWD Public Read Write. Permset with no Modify All for that object but Create/Edit Object/Field access

I think both options results in same end goal that all internal users have read access all records but folks with that permset have Read/Write access to all records of that object.

We want to know what is the best path to take from design and your experience point of view.

1 Answer 1


Modify All includes Transfer and Delete permissions, which means these two configurations are different. In the first scenario, the user can read, edit, change ownership, and delete records. You can't not give them delete access, because Modify All requires View All, Read, Edit, and Delete permissions as well. The second scenario still lets all users edit required fields, such as the record name or master-detail fields. It's still less harmful than the first option, though, as users can't delete or change ownership of those records. The correct solution is to have OWD set to Read Only, and then assign users to a Group, and using Sharing Rules to share with that Group. You'll have to assign users to that group, but this is no more complicated than adding a permission set to a user. You can even automate this in Apex if you want to.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .