I have a roles hierarchy like in the image attached. One Sales Manager and UNDER this role, two other roles: Sales_Europe and Sales_US. Assigned to these two roles, i have two users: user_a (Role: Sales_US) and user_b (Role: Sales_EU). THE OWD is set on PRIVATE for all objects and the Grant Access Using Hierarchy set on ON to all.

I do have Professional License.

I would like that Sales_EU does NOT see the accounts they do NOT own. (Unfortunatelly the user_a sees the contacts they do not own.)

The question: HOW can I enforce this security model? TIA

OvidiuSales Force Security Config - issue

  • Do you have any permissions on the profile of user-b or user-a to see or modify all records? – Mihai Neagoe Feb 16 '15 at 10:31
  • As I do have Professional License, I do not have access to such kind of settings on user level... (I do not see/got access the Profiles menu item). My users are created on built-in Standard Profile... – Ovidiu Diaconu Feb 16 '15 at 10:33
  • Reasons a user might be able to see a particular record 1) Permissions - view all data 2)Record Ownership 3) OWD - Read Only or Read/Write 4) Roles - above the owner 5) Sharing - Sharing rules or Manual Sharing. In your case 2,3&4 are not applicable what if someone is manually sharing or it could be the reason 1) View all permission on Contact object for their profiles. – Jarvis Feb 16 '15 at 13:38
  • @OvidiuDiaconu Does the user_a own any cases related to the contacts they can view currently? This may be due to implicit sharing. – Jarvis Feb 17 '15 at 19:25
  • @Bennie: no, they don't. But, based on the feedback I got from Mihai Neagoe, asking me to post the "Why?" screenshot, i found the (two) causes of that security issue: 1) somewhere, upper in the hierarchy, there was a role, who through an "Account sharing rule" was grating everybody below access to all accounts. 2) as well, there was an contact (rule) that was sharing his accounts with that role the user_a belongs... – Ovidiu Diaconu Feb 19 '15 at 8:18

Based on your schema you need to implement two sharing rules on Account and on other object you need to segregate the data.

We have role Euro and role US. The first sharing rule you create will say, any records created by role Euro give read/write access to role Euro. The second one will be for the US role and it will be the same as the first one.


Click on Expand List button which will point you to a list with all the reasons which user can what record and the reason.

Expand List

Let me know if it solved your problem.

  • I will give a try on your solution - and I will let you know afterwards. Therefore a Thank you in advance. Still, why they do see each other's records, if the OWD says everything should be Private? – Ovidiu Diaconu Feb 16 '15 at 11:24
  • It might be to do with the option Grant Access Using Hierarchy set to On and might give you some standard functionality that you might not desire. Read more here help.salesforce.com/… and see if it does what you think it does. – Mihai Neagoe Feb 16 '15 at 11:29
  • I did as instructed. But same (unwilling) behavior. I created an "account sharing rule" with the next settings: Account: Owned by members of Role: SALES_US, Share with: Role: SALES_US, Default account...: Read/Write, Contact access: R/W, all of them with R/W. And my user_a still have access to accounts not owned... :-( – Ovidiu Diaconu Feb 16 '15 at 12:06
  • Additional tests I did, revealed the next behavior: accounts created by user_a are not visible by user_b and vice-versa. But accounts created (owner) by other users, upper or in parallel hierarchies are visible in both user_a and user_b accounts... – Ovidiu Diaconu Feb 16 '15 at 12:21
  • 1
    @MihaiNeagoe: thanks for your tips. It helped me identifying and fixing the problems i had. – Ovidiu Diaconu Feb 19 '15 at 8:19

These are my overall settings.

Role Hierarchy Company OWD Account Sharing Rules Role definition

Add the WHY screenshot. How do I "read" this information? Thanks! Explanation of access

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.