Designing Record Access for Enterprise Scale

Designing Record Access for Enterprise Scale
Preface
Introduction
Group Membership Operations and Sharing Recalculation
Object Relationships, Bulk Loading, and Sharing Recalculation
Implicit Sharing
Parent-Child Data Skew
Record-Level Locking
Takeaway: Tuning Data Relationships and Updates for Performance
Tools for Large-Scale Realignments
Conclusion
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Implicit Sharing

The sharing capabilities of the Force.com platform include a wide variety of features that administrators can use to explicitly grant access to data for individuals and groups. In addition to these more familiar functions, there are a number of sharing behaviors that are built into Salesforce applications. This kind of sharing is called implicit because it is not configured by administrators; it is defined and maintained by the system to support collaboration among members of sales teams, customer service representatives, and clients or customers.

This table describes the different kinds of implicit sharing built into Salesforce applications and the record access that each kind provides.

Type of Sharing Provides Details
Parent Read-only access to the parent account for a user with access to a child record
  • Not used when sharing on the child is controlled by its parent
  • Expensive to maintain with many account children
  • When a user loses access to a child, Salesforce needs to check all other children to see if it can delete the implicit parent.
Child Access to child records for the owner of the parent account
  • Not used when sharing on the child is controlled by its parent
  • Controlled by child access settings for the account owner’s role
  • Supports account sharing rules that grant child record access
  • Supports account team access based on team settings
  • When a user loses access to the parent, Salesforce needs to remove all the implicit children for that user.
Boss Access to records owned by or shared to portal users for internal users
  • Shared to the role of the account owner
  • Also supports inheritance within portal roles
Portal Access to portal account and all associated contacts for all portal users under that account Shared to the lowest role under the portal account
Community1 Access to data owned by Community users under a portal for internal users who are members of the portal share group All members of the share group gain access to ever record owned by every Community portal user.
Community Parent Access to the parent accounts of child records shared through the Community portal share group for internal users who are members Maintains the ability to see the parent account when internal users are given access to account children owned by Community portal users

1To allow portal users to scale into the millions, Community users have a streamlined sharing model that does not rely on roles or groups, and functions similarly to calendar events and activities. Community users are provisioned with the Service Cloud Portal or Authenticated Website licenses.