A Salesforce administrator configures component visibility on a Lightning Record Page to hide a rich text field containing sensitive data from users who do not have the 'System Administrator' profile. A team member asserts that this configuration fully secures the data against unauthorized user access. Why is this assertion incorrect?
- Component visibility rules on Lightning pages only control UI display and do not restrict data access via reports, list views, or APIs.Answer
- BComponent visibility filters only function on mobile devices and have no effect on desktop browser views.
- CComponent visibility filters cannot evaluate user profile criteria unless a custom record type is also assigned.
- DHiding a component on a Lightning page automatically revokes read permissions for that object across the entire organization.
Answer
Component visibility rules on Lightning pages only control UI display and do not restrict data access via reports, list views, or APIs.
Lightning App Builder component visibility filters control rendering on record pages, but they do not secure the underlying data. Users with field-level access can still view the field via reports, SOQL/APIs, or list views.
Step-by-Step Solution
Key Concept
Lightning App Builder Component Visibility vs. Field-Level Security