Soru

Zorluk: ZorRole Hierarchy and Sharing Rules

Solaris Clean Energy uses a custom object named Site_Inspection__c to log site safety reviews. The Organization-Wide Default (OWD) for Site_Inspection__c is configured as Private. To comply with privacy requirements for individual inspection reports, the System Administrator deselects the 'Grant Access Using Hierarchies' setting for Site_Inspection__c.

Later, to facilitate management oversight of urgent compliance issues, the administrator creates a criteria-based sharing rule that shares all Site_Inspection__c records where Safety_Risk__c = 'High' with the 'Regional Safety Lead' role, granting Read/Write access. A user assigned to the 'VP of Operations' role—which sits directly above the 'Regional Safety Lead' role in the role hierarchy—attempts to open a 'High' risk inspection record owned by a field auditor.

Which statement accurately describes the level of access the VP of Operations will have to this record?

  1. The VP of Operations will have no access to the record because deselecting Grant Access Using Hierarchies prevents automatic upward access inheritance through the role hierarchy.Cevap
  2. B
    The VP of Operations will inherit Read/Write access to the record because sharing rules always propagate access to higher roles in the hierarchy regardless of custom object settings.
  3. C
    The VP of Operations will have Read-Only access to the record because Salesforce automatically downgrades inherited sharing rule access by one level for superior roles.
  4. D
    The VP of Operations will have Read/Write access only if the administrator creates a custom profile to grant explicit additive object permissions for executive roles.

Cevap

The user in the VP of Operations role will have no access to the record because deselecting Grant Access Using Hierarchies for a custom object disables automatic upward access inheritance, even for records shared via sharing rules.
For custom objects in Salesforce, the 'Grant Access Using Hierarchies' option can be deselected. When deselected, users higher in the role hierarchy do NOT automatically gain access to records owned by or shared with users below them in the hierarchy. Consequently, the executive role receives no access to the record shared with the regional role.

Adım Adım Çözüm

1
Evaluate the baseline Organization-Wide Default (OWD) and hierarchy settings.
The OWD for Site_Inspection__c is Private, and 'Grant Access Using Hierarchies' is unchecked (disabled).
For standard objects, hierarchy access is always enabled. For custom objects, deselecting this option stops users higher in the role hierarchy from automatically inheriting record access owned by or shared with subordinate roles.
2
Analyze the scope of the criteria-based sharing rule.
The rule shares 'High' risk records directly with the 'Regional Safety Lead' role with Read/Write access.
The rule explicitly grants access to members of the Regional Safety Lead role.
3
Determine whether the VP of Operations inherits access from the Regional Safety Lead role.
Because 'Grant Access Using Hierarchies' is disabled on the custom object, the VP of Operations role does not inherit access granted to the lower role via the sharing rule.
Disabling hierarchy access for custom objects blocks all implicit upward inheritance for both record ownership and shared record access.

Anahtar Kavram

Custom Object Hierarchy Access Control
Tahmini Süre:1m 30s
Bu soruyu puanla