My org contains many companies that are effectively separate but belong to the same group. Some of these companies indirectly compete one against another, though this is not encouraged.
My issue is that I have to reduce the number of profiles down from an average of 3 users per profile, combine the companies that can be combined and then add value.
Inside the group there are Product and Solution managers who own the products and solutions that we offer. These people want visibility into products and need the ability to run reports on what products are being used in opportunities.
There are also Vertical managers who want to see what is happening in their are of influence: Government, for example.
For almost every deal an architect needs to be added and this will be done by the PMO once they have ascertained the requirements.
There are also sales assistants who do most of the work for the Sales people (something I will be fixing after we have resolved the current problem). Sales Assistant Alex does work for Sales people Bennie, Claire, David and Erin all of whom report to Manager Fred while Alex reports to her manager Gavin. Now Alex will also back up Sales Assistant Holly while she is on vacay so now Alex works on behalf of B thru E and I thru M - but only while Holly is away.
I am trying to limit visibility within the org but absolutely everybody states that they require access at all times. As that is clearly an overstatement of the truth I am trying to work out the best way to approach this.
I thought a trigger on the Opp that would fire a class that examines all of the fields on the record and grant or remove access from people mentioned in the fields in the opp. Then I though about using Process Builder but am not sure if that will work.
I know I'm not the only one with a complicated org structure and who is more than a bit shy of full and open sharing so what have other teams done to improve security without detracting from #awesome...?