I have four record types as follows:

  1. Master
  2. Owner
  3. Contractor
  4. Partner

Master record type is for creating parent accounts. So the requirement is the users should only be able to read the Master record type records but not delete, create, or modify.

How can I achieve this?

Any insights would be appreciated.

Thank you.

  • You don't mention which object. Custom objects and standard objects can have some different behaviors. Is this a custom object? If not, which standard object is it?
    – pchittum
    Commented May 6, 2015 at 15:44
  • Hey Peter ... this is a standard object Account Commented May 7, 2015 at 14:39

4 Answers 4


The control of deletion and edits to records of the given record types should be attempted with object sharing model configurations. In fact, the whole purpose of the sharing model is for the use case you outline: to distinguish security and data access between different records for different users.

First set the sharing of your object to Public Read Only. You do this in Setup > Security Controls > Sharing Settings. At the top of that page is your Organization Wide Default sharing settings. Edit and set your object's settings.

Now create a sharing rule (on the same page as above) that will let everyone edit the child records. For those record types, you can use a criteria-based sharing rule that will allow read/write access to the All Internal Users public group (a default group).

Allow "All Internal Users" to Edit Records of a given Record Type

You can select multiple record types in your criteria, so pick the ones that apply in your situation: Owner, Contractor, Partner

Here's the thing...record owners always have View, Edit, Share, Transfer, and Delete permissions. Presumably someone is creating those...so to prevent those being edited you might consider assigning those Master records to an Administrator user, or in the case of Lead, Case, or Custom Objects, a public group.

This whitepaper is a good place to understand the underlying architecture. You should also read through the online help on the sharing model. Getting this right can save you tons of pointless hacky customizations both in clicks and code.


Get to know the sharing model and record access, you will be able to solve problems like this without code or even validation rules.


You need to configure either profiles/permission sets or security model. Using record types you can only differentiate UI of the same record, but not the security setting. https://help.salesforce.com/HTViewHelpDoc?id=customize_recordtype.htm


To prevent the creation of records with a certain record type, go to

Setup => Manage Users => Profiles => Object Settings

and remove the record type from the assignments for that profile.

To prevent edit and delete, you got to be a bit more creative since you can only set this per profile on an object level, not record type. You can assign a separate page layout to this record type, where you remove the edit and delete buttons and make all fields read-only.

This is still not 100% secure (since required fields will still be editable through inline editing, and the fields are only read-only through the Salesforce UI...), so you would have to go for a trigger to block off edit and delete (edit only would be possible through a validation rule).


In the security settings, for each profile + object, you can specify which record types are "available."

This means if you don't include the Master recordType, then users cannot create records and select Master, nor can they change the recordType on edit to Master.

Making a recordType unavailable does not mean the visibility to the record is also removed. In our enviroment, we have an integration create new records with a special record type which is not availble to standard users.

To prevent changes or deletes, you can simply create a validation rule that checks whether the following are all TRUE:

  1. RecordType = "Master"
  2. Profile != "System Administrator"
  3. ISCHANGED(LastModifiedDate) -- this ensures the record is not modified

To prevent deletion, you'll need to create a simple trigger that runs before delete

  • The validation rule will only block edits to the record, on delete this will not fire. Commented May 6, 2015 at 14:51
  • @RobinDeBondt, my mistake. Thanks for bringing it up. comment edited
    – James
    Commented May 6, 2015 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .