FieldRestrictionRule

Represents a field visibility rule that controls whether a field is visible to a user, based on the field’s compliance categorization. This type extends the Metadata metadata type and inherits its fullName field.

File Suffix and Directory Location

FieldRestrictionRule components have the suffix .rule and are stored in the fieldRestrictionRules folder.

Version

FieldRestrictionRule components are available in API version 52.0 and later.

Special Access Rules

To access this type, you must have the Manage Sharing permission.
To create and manage Employee field visibility rules, you must be assigned a Workplace Command Center permission set license and the Provides access to Workplace Command Center features system permission.
To create and manage User field visibility rules, you must enable Digital Experiences and the Enhanced Personal Information Management feature.

Fields

Field Name	Field Type	Description
active	boolean	Indicates whether the rule is active (`true`) or not (`false`). The default value is `false`.
classification	string[]	The data classification compliance categorization that is targeted by the rule. The rule applies to fields that are marked with this categorization. You can use Salesforce's default compliance categorization values or values that you add yourself.
description	string	Required. The description of the rule.
enforcementType	EnforcementType (enumeration of type string)	Required. The type of rule. Possible values are: `FieldRestrict`—Field visibility rule. Only this value is valid. `Restrict`—Do not use. `Scoping`—Do not use.
masterLabel	string	Required. The name of the rule.
recordFilter	string	Required. The criteria that determine which fields are visible to the specified users. For example, the field can check if the logged-in user matches the Employee’s ID.
targetEntity	string	Required. The object for which you're creating the rule. Only the Employee and User objects are supported.
userCriteria	string	Required. The users that this rule applies to, such as all active users or users with a specified role or profile.
version	int	The rule's version number.

Declarative Metadata Sample Definition

The following is an example of a FieldRestrictionRule component.

1<?xml version="1.0" encoding="UTF-8"?>
2<FieldRestrictionRule xmlns="http://soap.sforce.com/2006/04/metadata">
3    <active>true</active>
4    <classification>PII</classification>
5    <description>Is Owner of Employee</description>
6    <enforcementType>FieldRestrict</enforcementType>
7    <masterLabel>Is Owner Field Restriction Rule</masterLabel>
8    <recordFilter>OwnerId = $User.Id</recordFilter>
9    <targetEntity>Employee</targetEntity>
10    <userCriteria>$User.IsActive = true</userCriteria>
11    <version>1</version>
12</FieldRestrictionRule>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>FieldRestrictionRule</name>
6    </types>
7    <version>52.0</version>
8</Package>

Metadata API Developer Guide