Universal Containers recently deployed a custom object named Project__c to manage sensitive internal deliverables. The security team requires that users can only view Project records they explicitly own. However, managers must automatically inherit access to Project records owned by their subordinates in the role hierarchy. Additionally, an administrator suggested leaving the default sharing open and removing Read permissions on user profiles to restrict visibility. Which configuration strategy correctly fulfills the security requirements according to Salesforce security best practices?
- Set the Organization-Wide Default (OWD) for Project__c to Private, and ensure Grant Access Using Hierarchies remains checked.Cevap
- BSet the Organization-Wide Default (OWD) for Project__c to Public Read-Only, and remove Read object permissions on the profiles of non-manager users.
- CSet the Organization-Wide Default (OWD) for Project__c to Private, and uncheck Grant Access Using Hierarchies, assuming custom objects automatically grant hierarchy access like standard objects.
- DSet the Organization-Wide Default (OWD) for Project__c to Public Read/Write, and assign a restrictive permission set to block record access for non-owner users.
Cevap
Set the Organization-Wide Default (OWD) for Project__c to Private, and ensure Grant Access Using Hierarchies remains checked.
The correct approach sets the Organization-Wide Default to Private to establish the most restrictive baseline access, ensuring non-owners cannot see Project records by default. Retaining the Grant Access Using Hierarchies setting enables higher roles in the hierarchy to view records owned by subordinates.
Adım Adım Çözüm
Anahtar Kavram
Organization-Wide Defaults (OWD) and Role Hierarchy Access Propagation