Examkin

Question

Difficulty: MediumRole Hierarchy and Sharing Rules

Nexus Logistics utilizes a custom object named Asset_Maintenance__c to record equipment inspection reports. The Organization-Wide Default (OWD) for Asset_Maintenance__c is set to Private. Under default Salesforce security settings, regional managers can automatically view all inspection reports owned by branch supervisors below them in the role hierarchy. However, strict internal audit compliance requires that high-priority maintenance reports owned by branch supervisors be shared with the Quality Assurance team, while preventing managers higher in the role hierarchy from inheriting access to these specific records.

Which configuration change should the System Administrator make on the Asset_Maintenance__c object to satisfy these requirements?

  1. Deselect the 'Grant Access Using Hierarchies' setting for the Asset_Maintenance__c object in Organization-Wide Defaults, then create a criteria-based sharing rule to share high-priority records with the Quality Assurance group.Answer
  2. B
    Create a Permission Set that removes Object-Level Read access for Asset_Maintenance__c and assign it to the regional managers higher in the hierarchy.
  3. C
    Configure an owner-based sharing rule that grants Read access to Quality Assurance and select the option to exclude managers in the role hierarchy options of the sharing rule wizard.
  4. D
    Change the Organization-Wide Default (OWD) of Asset_Maintenance__c to Public Read-Only so all users can view records without relying on the role hierarchy.

Answer

Deselect the 'Grant Access Using Hierarchies' setting for the Asset_Maintenance__c object in Organization-Wide Defaults, then create a criteria-based sharing rule to share high-priority records with the Quality Assurance group.
For custom objects, the 'Grant Access Using Hierarchies' checkbox in Organization-Wide Defaults is enabled by default. When enabled, any record access granted to a role (via ownership or sharing rules) automatically rolls up to managers higher in the role hierarchy. Unchecking this setting disables automatic hierarchy access for the custom object, allowing criteria-based sharing rules to share records exclusively with specified groups such as Quality Assurance.

Step-by-Step Solution

1
Analyze standard role hierarchy record access behavior for custom objects in Salesforce.
By default, Salesforce custom objects have 'Grant Access Using Hierarchies' enabled, meaning managers always inherit record access granted to lower-level roles.
To prevent managers up the role hierarchy from gaining access to records shared with or owned by subordinates, hierarchy-based access inheritance must be explicitly disabled on the custom object.
2
Disable hierarchy access propagation in Organization-Wide Defaults (OWD).
Unchecking 'Grant Access Using Hierarchies' for Asset_Maintenance__c prevents higher-level roles from automatically seeing records owned by or shared with subordinates.
This is the only setting that isolates record sharing to specifically targeted groups without propagating access upwards.
3
Define targeted record sharing using criteria-based sharing rules.
A criteria-based sharing rule evaluates fields (e.g., Priority = High) and shares matching Asset_Maintenance__c records with the Quality Assurance public group.
This grants access strictly to the required team while respecting the disabled hierarchy access.

Key Concept

Disabling 'Grant Access Using Hierarchies' on Custom Objects in Organization-Wide Defaults
Rate this question

Topics

Role Hierarchy and Sharing Rules

More questions from this topic