In Salesforce, data security is one of the most important aspects of any organization. Not every user should have access to all records because some data may be confidential, sensitive, or irrelevant to certain roles.
As a system administrator, I was working in a company that uses Salesforce to manage its business, and I’m responsible for managing users, objects, and profile permissions, and overall organization security.
In our organization, there is a Recruitment Team that uses the custom object called Job Application. Initially, every recruiter could see all job applications in the system, regardless of who created them.
The recruitment manager wanted one recruiter to be unable to see another recruiter’s candidates’ job applications.
However, recruitment managers should still be able to see all applications for their team members.
In this article, we will learn about how to restrict record access for users in Salesforce using different methods like Organization-Wide Defaults (OWD), Role Hierarchy, Sharing Rules, and Restriction Rules.
What is Record-Level Security in Salesforce?
Record-level security in Salesforce controls which records a user can see and access.
Even if a user has object permission (Create, Read, Edit, Delete), they may still not be able to see all records unless access is granted.
Salesforce provides multiple layers of security:
- Object Level Security (Profiles & Permission Sets)
- Field Level Security
- Record Level Security (this article focuses)
Record-level access ensures users see only relevant data and prevents unauthorized access.
Why Do We Need to Restrict Record Access?
Restricting access is important because:
- Protect sensitive data
- Avoid data misuse
- Improve performance (less data visibility)
- Maintain compliance and security
For example, if all employees can see salary records, it creates a security risk.
User Access on Object in Salesforce
Now, in the screenshot below, you can see the Recruitment profile.
This profile has object-level access for the Job Application object, which means recruiters can Create, Read, Edit, and Delete the job application records they have access to.
We have two users assigned to the recruitment profile. Both of these users have the same object-level permissions for the Job Application object as defined in the profile.
- John Joy.
- Alexander Joy.
When I log in as John Joy, you can see that he has access to all records in the job application object. This means he can also view records owned by other users.
Additionally, when I log in as Alexander Joy, another user from the recruitment team, I can view all records in the job application object, including those owned by other recruiters.
This is happening because the Organization-Wide Default (OWD) in Salesforce for the job application object is currently set to Public Read/Write (or Public Read Only).
With this sharing setting:
- All users with object-level permission can see all records for that object.
- They can also edit them if OWD is Public Read/Write.
That’s why both John Joy and Alexander Joy can see each other’s job application records.
Now, let’s change the OWD for the job application object to private so that all users can only access the records they own.
With this setting, users cannot see each other’s records; they will only be able to see the records they own.
After changing the OWD to private and logging in as Alexander Joy, you can see that he is no longer able to view other users’ records. Instead, he can only see the job application records that he owns.
Earlier, in the Job Application object, all users could see each other’s records. This confused and posed a security risk, as unauthorized individuals could access private candidate information.
Like Alexander Joy, other users will only see the records they own. They will not be able to view records owned by other users.
Now, as per the scenario, we want the manager to be able to see the recruiters’ records. This can be achieved by establishing a role hierarchy where the manager’s role is above the recruiters’ role, thereby granting the manager access to their team members’ records.
In the screenshot below, you can see we have two different profiles, the Recruitment Team and the Manager profile. The recruitment team profile is assigned to recruiters, and the manager profile is assigned to users who need access to their team’s records.
When I log in with a manager profile (Ella Edward) and navigate to the job application object to view the recruiter team’s job application records, I am unable to see them.
This is because our OWD is set to private, and the role hierarchy has not yet been configured to allow managers to access their team members’ records.
As you can see in the role hierarchy, we have defined two roles: manager and recruiter.
Now, we need to assign these roles to the respective users so that managers can automatically get access to the records owned by their team members.
After assigning roles to users, we need to check the Grant Access Using Hierarchies setting for the Job Application object in Sharing Settings.
This ensures that managers (higher in the role hierarchy) can automatically access the records owned by users below them.
Now, as I log in with the manager, Ella Edward, you can see in the image below that she is able to view the records owned by the recruiters.
This is because the Role Hierarchy and Grant Access Using Hierarchies setting allows managers to access their team members’ records.
In this way, we can control record access in Salesforce by using OWD to restrict access and role hierarchy.
Frequently Asked Questions
Q1: Can we restrict access without OWD?
No, OWD is a mandatory baseline
Q2: What is the best way to restrict records?
Use:
1. OWD = Private
2. Role Hierarchy
3. Restriction Rules
Q3: Do profiles control record access?
No, they control object access
Q4: What is the difference between sharing and restriction?
1. Sharing = giving access
2. Restriction = limit access
Conclusion
Restricting record access in Salesforce is essential for maintaining data security and ensuring users only see relevant information.
By using Organization-Wide Defaults, Role Hierarchy, Sharing Rules, and Restriction Rules together, you can create a secure and efficient system.
I have explained the process using Organization-Wide Defaults (OWD) to make records private, and then used the Role Hierarchy to allow managers to access their team members’ records while keeping other users’ data secure.
You may like to read:
- Salesforce Field Security in SOQL WITH Security Enforced
- How to Get Security Token in Salesforce
- Salesforce Flow: Add Users to Public Group Without Code
I am Bijay Kumar, the founder of SalesforceFAQs.com. Having over 10 years of experience working in salesforce technologies for clients across the world (Canada, Australia, United States, United Kingdom, New Zealand, etc.). I am a certified salesforce administrator and expert with experience in developing salesforce applications and projects. My goal is to make it easy for people to learn and use salesforce technologies by providing simple and easy-to-understand solutions. Check out the complete profile on About us.
