1

I have a roles hierarchy like in the image attached. One Sales Manager and UNDER this role, two other roles: Sales_Europe and Sales_US. Assigned to these two roles, i have two users: user_a (Role: Sales_US) and user_b (Role: Sales_EU). THE OWD is set on PRIVATE for all objects and the Grant Access Using Hierarchy set on ON to all.

I do have Professional License.

I would like that Sales_EU does NOT see the accounts they do NOT own. (Unfortunatelly the user_a sees the contacts they do not own.)

The question: HOW can I enforce this security model? TIA

OvidiuSales Force Security Config - issue

Improve this question
5
  • Do you have any permissions on the profile of user-b or user-a to see or modify all records?
    – Mihai Neagoe
    Commented Feb 16, 2015 at 10:31
  • As I do have Professional License, I do not have access to such kind of settings on user level... (I do not see/got access the Profiles menu item). My users are created on built-in Standard Profile...
    – Ovidiu Diaconu
    Commented Feb 16, 2015 at 10:33
  • Reasons a user might be able to see a particular record 1) Permissions - view all data 2)Record Ownership 3) OWD - Read Only or Read/Write 4) Roles - above the owner 5) Sharing - Sharing rules or Manual Sharing. In your case 2,3&4 are not applicable what if someone is manually sharing or it could be the reason 1) View all permission on Contact object for their profiles.
    – Jarvis
    Commented Feb 16, 2015 at 13:38
  • @OvidiuDiaconu Does the user_a own any cases related to the contacts they can view currently? This may be due to implicit sharing.
    – Jarvis
    Commented Feb 17, 2015 at 19:25
  • @Bennie: no, they don't. But, based on the feedback I got from Mihai Neagoe, asking me to post the "Why?" screenshot, i found the (two) causes of that security issue: 1) somewhere, upper in the hierarchy, there was a role, who through an "Account sharing rule" was grating everybody below access to all accounts. 2) as well, there was an contact (rule) that was sharing his accounts with that role the user_a belongs...
    – Ovidiu Diaconu
    Commented Feb 19, 2015 at 8:18

2 Answers 2

Reset to default
-1

Based on your schema you need to implement two sharing rules on Account and on other object you need to segregate the data.

We have role Euro and role US. The first sharing rule you create will say, any records created by role Euro give read/write access to role Euro. The second one will be for the US role and it will be the same as the first one.

sharing

Click on Expand List button which will point you to a list with all the reasons which user can what record and the reason.

Expand List

Let me know if it solved your problem.

Improve this answer
11
  • I will give a try on your solution - and I will let you know afterwards. Therefore a Thank you in advance. Still, why they do see each other's records, if the OWD says everything should be Private?
    – Ovidiu Diaconu
    Commented Feb 16, 2015 at 11:24
  • It might be to do with the option Grant Access Using Hierarchy set to On and might give you some standard functionality that you might not desire. Read more here help.salesforce.com/… and see if it does what you think it does.
    – Mihai Neagoe
    Commented Feb 16, 2015 at 11:29
  • I did as instructed. But same (unwilling) behavior. I created an "account sharing rule" with the next settings: Account: Owned by members of Role: SALES_US, Share with: Role: SALES_US, Default account...: Read/Write, Contact access: R/W, all of them with R/W. And my user_a still have access to accounts not owned... :-(
    – Ovidiu Diaconu
    Commented Feb 16, 2015 at 12:06
  • Additional tests I did, revealed the next behavior: accounts created by user_a are not visible by user_b and vice-versa. But accounts created (owner) by other users, upper or in parallel hierarchies are visible in both user_a and user_b accounts...
    – Ovidiu Diaconu
    Commented Feb 16, 2015 at 12:21
  • 1
    @MihaiNeagoe: thanks for your tips. It helped me identifying and fixing the problems i had.
    – Ovidiu Diaconu
    Commented Feb 19, 2015 at 8:19
0

These are my overall settings.

Role Hierarchy Company OWD Account Sharing Rules Role definition

Add the WHY screenshot. How do I "read" this information? Thanks! Explanation of access

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .