Examkin

Question

Difficulty: Very hardRole Hierarchy and Sharing Rules

An administrator is configuring record-level access for a custom object named Project__c. The Organization-Wide Default (OWD) sharing setting for Project__c is set to Private. To restrict access, the administrator deselects the 'Grant Access Using Hierarchies' option for Project__c. User A is assigned to the 'Project Executive' role, which sits directly above User B's role ('Project Coordinator') in the Role Hierarchy. Both users have a profile that grants Read, Create, Edit, and Delete permissions on the Project__c object. User B creates a new Project__c record. Based on this configuration, which statement correctly describes access to User B's record?

  1. Only User B (the record owner) has access to the record, because disabling Grant Access Using Hierarchies stops automatic upward access inheritance through the Role Hierarchy for custom objects.Answer
  2. B
    User A automatically receives Read/Write access to the record because User A's profile grants Edit object-level permission on Project__c.
  3. C
    User A automatically receives Read Only access because Grant Access Using Hierarchies cannot be disabled when OWD is Private.
  4. D
    User A automatically receives Read/Write access because the Role Hierarchy always overrides custom object Organization-Wide Defaults.

Answer

Only the record owner (User B) has access to the record, because deselecting 'Grant Access Using Hierarchies' stops automatic upward access inheritance through the Role Hierarchy for custom objects.
For standard objects, access is always granted through the Role Hierarchy. However, for custom objects, administrators can deselect the 'Grant Access Using Hierarchies' checkbox. Doing so prevents users in higher roles (like User A) from automatically inheriting access to custom object records owned by or shared with users in subordinate roles (like User B). Since OWD is Private and no sharing rules are active, only the record owner has access.

Step-by-Step Solution

1
Evaluate Organization-Wide Defaults (OWD)
OWD for Project__c is Private, meaning users do not get automatic access to records owned by others unless shared.
OWD sets the baseline level of access for all records of an object across the organization.
2
Check the status of Grant Access Using Hierarchies
The setting is deselected (disabled) for the Project__c custom object.
For custom objects, administrators can uncheck 'Grant Access Using Hierarchies', which revokes implicit record access propagation up the Role Hierarchy.
3
Differentiate Profile Object Permissions (CRUD) from Record-Level Sharing
User A's profile Edit permission allows editing records User A can access, but does not grant visibility to unshared Private records owned by User B.
Profile object permissions specify what operations users can perform, while sharing rules/hierarchy determine which specific records users can see.

Key Concept

Grant Access Using Hierarchies behavior on Custom Objects
Rate this question

Topics

Role Hierarchy and Sharing Rules

More questions from this topic