Apex Manage Sharing rule vs permissionsets/Profiles

Question

I have a Master detail object R/S, Request(Parent) and Feedback OWD is Private.

Master record (with child records) will be created by a user 'A' and the ownership will be assigned to user 'B'.

Once the record is created by user 'A' I want to give this user only the 'Read' access with an Apex Manage Sharing Rule.

Sharing result as follows;

The problem is; Still user 'A' can edit the record :(, and I want to know;

could I give initial access to User 'A' and 'B' with profile(s)or permission set(s)?

If yes, what kind of permissions needs to be there?

Could someone help me with this as this is my first Apex Managed Sharing development experience.

Answer 1

By default, the user who created the record is the Owner, which has 'Full' access to the record.

You need to remove User 'A' as Owner.

I would suggest that you just create Queue and then create a workflow rule that sets the owner of every new record to that Queue.

It owner switching can also be done via trigger, i.e.:

trigger.new[0].ownerId = QueueId;

By the way, profiles/permission sets and Sharing rule have different purpose and scope.

Answer 2

I found the cause for this issue, This user A and B are in the same role hierarchy, as user A is a manager of user B user A still have the full access to the records.

To remove the accessibility through Hierach, I unchecked Grant Access Using Hierarchies in Sharing Settings