Designing Record Access for Enterprise Scale

Designing Record Access for Enterprise Scale
Preface
Introduction
Group Membership Operations and Sharing Recalculation
Object Relationships, Bulk Loading, and Sharing Recalculation
Implicit Sharing
Parent-Child Data Skew
Record-Level Locking
Takeaway: Tuning Data Relationships and Updates for Performance
Tools for Large-Scale Realignments
Conclusion
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Implicit Sharing

The sharing capabilities of the Lightning Platform include a wide variety of features that administrators can use to explicitly grant access to data for individuals and groups. In addition to these more familiar functions, there are a number of sharing behaviors that are built into Salesforce applications. This kind of sharing is called implicit because it’s not configured by administrators; it’s defined and maintained by the system to support collaboration among members of sales teams, customer service representatives, and clients or customers.

This table describes the different kinds of implicit sharing built into Salesforce applications and the record access that each kind provides.

Type of Sharing Provides Details
Parent Read-only access to the parent account for a user with access to a child record
  • Not used when sharing on the child is controlled by its parent
  • Expensive to maintain with many account children
  • When a user loses access to a child, Salesforce must check all other children to see if it can delete the implicit parent.
Child Access to child records for the owner of the parent account
  • Not used when sharing on the child is controlled by its parent
  • Controlled by child access settings for the account owner’s role
  • Supports account sharing rules that grant child record access
  • Supports account team access based on team settings
  • When a user loses access to the parent, Salesforce removes the user’s access to all children records too.

After faster account sharing recalculation is enabled, we no longer store implicit share records between accounts and their child case, contact, and opportunity records. Instead, the system dynamically determines whether users can access these records when they try to access them. For more information, see the Faster Account Sharing Recalculation knowledge article.
Site or Portal Access to a site or portal account and all associated contacts for all site or portal users under that account Shared the lowest role under the site or portal account
High Volume1 Access to data owned by high-volume users associated with a sharing set for users member of the sharing set's access group All members of the sharing set access group gain access to every record owned by every high-volume user associated with that sharing set
High Volume Parent Read only access to the parent account of records shared through a sharing set's access group for users member of the group Maintains the ability to see the parent account when users are given access to account children owned by high-volume users

1To allow external users to scale into the millions, high-volume users have a streamlined sharing model that doesn’t rely on roles or groups, and functions similarly to calendar events and activities. High-volume users include the Customer Community, High Volume Customer Portal, and Authenticated Website license types.