An organization relies on a custom object named Risk_Assessment__c to document compliance reviews. Executive leadership mandates that by default, only record owners and managers higher in the role hierarchy should have access to view and edit risk assessment records. Unrelated peers and lower-level staff must have no visibility. Which Organization-Wide Default (OWD) setting should the administrator select to establish this baseline access model?
- Private, while keeping Grant Access Using Hierarchies selected.Answer
- BPublic Read-Only, and configure object permissions on user profiles to revoke view access for unauthorized users.
- CPrivate, and deselect Grant Access Using Hierarchies because custom objects do not support automatic hierarchy access propagation.
- DPublic Read/Write, and assign a restrictive permission set to remove record access from lower-level staff.
Answer
The baseline access setting should be configured as Private with Grant Access Using Hierarchies enabled.
Setting the Organization-Wide Default (OWD) to Private establishes the most restrictive baseline access, ensuring users cannot view records owned by others unless explicitly shared. Because Grant Access Using Hierarchies is enabled by default on custom objects, superior roles in the role hierarchy automatically inherit access to records owned by lower-level staff.
Step-by-Step Solution
Key Concept
Organization-Wide Defaults (OWD) define the baseline record-level security in Salesforce. Profiles and permission sets cannot restrict record access beyond the baseline established by OWD.