2

My org contains many companies that are effectively separate but belong to the same group. Some of these companies indirectly compete one against another, though this is not encouraged.

My issue is that I have to reduce the number of profiles down from an average of 3 users per profile, combine the companies that can be combined and then add value.

Inside the group there are Product and Solution managers who own the products and solutions that we offer. These people want visibility into products and need the ability to run reports on what products are being used in opportunities.

There are also Vertical managers who want to see what is happening in their are of influence: Government, for example.

For almost every deal an architect needs to be added and this will be done by the PMO once they have ascertained the requirements.

There are also sales assistants who do most of the work for the Sales people (something I will be fixing after we have resolved the current problem). Sales Assistant Alex does work for Sales people Bennie, Claire, David and Erin all of whom report to Manager Fred while Alex reports to her manager Gavin. Now Alex will also back up Sales Assistant Holly while she is on vacay so now Alex works on behalf of B thru E and I thru M - but only while Holly is away.

I am trying to limit visibility within the org but absolutely everybody states that they require access at all times. As that is clearly an overstatement of the truth I am trying to work out the best way to approach this.

I thought a trigger on the Opp that would fire a class that examines all of the fields on the record and grant or remove access from people mentioned in the fields in the opp. Then I though about using Process Builder but am not sure if that will work.

I know I'm not the only one with a complicated org structure and who is more than a bit shy of full and open sharing so what have other teams done to improve security without detracting from #awesome...?

Improve this question
3
  • Great question and interesting use case. But won't be able to answer without login to the org :) However, a superb design of permissions sets and trigger on selected objects would suffice it.
    – Ashwani
    Aug 17, 2015 at 15:19
  • 1
    Have you gone through basic help features and training on these subjects ? The question(s) as phrased are very broad and hard to answer in our site format. Solving this usually takes quite some hours/days, workshops and decisions within an organisation.
    – Samuel De Rycke
    Aug 17, 2015 at 17:05
  • Absolutely. I've gone right back to basics and have some good ideas but wonder if there might be ways that I have not yet considered.
    – SeanGorman
    Aug 17, 2015 at 19:30

1 Answer 1

Reset to default
3

This is a very broad question you're asking and probably too complex for any of us to give you a single answer. I think you're going to need to go back to the basics as taught in the Force.com Platform Fundamentals to sort out your OWD, FLS, base profiles, Roles, permission sets and Groups along with deciding whether or not Conditional Permissions and/or Apex Sharing Rules would be beneficial to your org.

Another important thing to consider is whether or not your Org uses Account Roles and Opportunity Teams. Clearly there's no "one right way" or "one fits all" solution to apply. It's going to require you to do some serious analysis of the real needs of your org, including who should see what at any given time in your sales stages and who shouldn't. That solution might also involve Record Types as well as Stages change.

I'd recommend you collect all the input (in writing) from everyone affected and do your analysis, plus verify among those involved that all are in agreement with what the other players have said about their needs for access. If they're not, you'll want to see that those discrepancies are negotiated at the right levels and agreement is reached before proceeding towards a solution.

Buy-in from all involved will be essential to your success.

Improve this answer
3
  • 1
    Absolutely. I have been considering this for a few weeks and have gone right back to my old books. I have the roles and profiles done. Permission sets to fix any holes in that but conditional sharing rules will have to take me the rest of the way.
    – SeanGorman
    Aug 17, 2015 at 19:28
  • 1
    I'll add that I don't see where Process Builder is going to offer any tools that will be of great use in helping you accomplish the task of sorting this out. That's simply not its purpose.
    – crmprogdev
    Aug 17, 2015 at 20:05
  • Thank you crmprogdev - that's exactly what I need. I was wondering if I could set up something to add a sharing rule but could never get it to work.
    – SeanGorman
    Aug 18, 2015 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .