Designing Record Access for Enterprise Scale

Designing Record Access for Enterprise Scale
Preface
Introduction
Group Membership Operations and Sharing Recalculation
Object Relationships, Bulk Loading, and Sharing Recalculation
Implicit Sharing
Parent-Child Data Skew
Record-Level Locking
Takeaway: Tuning Data Relationships and Updates for Performance
Tools for Large-Scale Realignments
Conclusion
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Implicit Sharing

The sharing capabilities of the Lightning Platform include a wide variety of features that administrators can use to explicitly grant access to data for individuals and groups. In addition to these more familiar functions, there are a number of sharing behaviors that are built into Salesforce applications. This kind of sharing is called implicit because it’s defined and maintained by the system to support collaboration among members of sales teams, customer service representatives, and clients or customers.

This table describes the different kinds of implicit sharing built into Salesforce applications and the record access that each kind provides.

Type of Sharing Provides Details Example
Parent Read-only access to the parent account for a user with access to a child case, contact, or opportunity
  • Not used when sharing on the child is controlled by its parent
  • Expensive to maintain with many account children
  • When a user loses access to a child, Salesforce must check all other children to see if it can delete the implicit parent.
  • Not granted by the View All permission on the child object
 Henry is a Standard User with access to an opportunity through an owner-based sharing rule. He can view data about the opportunity’s parent account, but he can’t edit the account’s data.
Child Access to child case, contact, or opportunity records for the owner of the parent account
  • Not used when sharing on the child is controlled by its parent
  • Controlled by child access settings for the account owner’s role
  • Supports account sharing rules that grant child record access
  • Supports account team access based on team settings
  • When a user loses access to the parent, Salesforce removes the user’s access to all children records
  • Not granted by the View All permission on the parent object

After faster account sharing recalculation is enabled, we no longer store implicit share records between accounts and their child case, contact, and opportunity records. Instead, the system dynamically determines whether users can access these records when they try to access them. For more information, see the Faster Account Sharing Recalculation knowledge article.

 Henry is a Standard User who owns an account. The System Admin set up Henry’s role so that assigned users can view all opportunities, cases, and contacts associated with accounts they own. Henry can therefore view data for all of the child opportunities, cases, and contacts for the account he owns, but he can’t edit this data.
Site or Portal Access to a site or portal account and all associated contacts for all site or portal users under that account. Access to a case for the site or portal user that’s the contact on the case. Account and associated contacts shared with the lowest role under the site or portal account Sarah is a Customer Community Plus User added under the “Acme” account. Sarah has Read access to the “Acme” account as well as Read access to all the other contacts related to the account.
High Volume1 Full access to data owned by high-volume users associated with a sharing set for members of the sharing set's share group All members of the sharing set’s share group gain full access to every record owned by every high-volume user associated with that sharing set For your site, a sharing set is created to grant high-volume users on the same account Read Only access to each other’s cases. Internal users added to the sharing set’s share group have full access to these cases.
High Volume Parent Read only access to the parent account of records shared through a sharing set's share group for members of the share group Maintains the ability to see the parent account when users are given access to account children owned by high-volume users For your site, the same sharing set for cases mentioned in the previous example automatically gives the internal users added to the share group read access to the cases’ parent accounts.

1To allow external users to scale into the millions, high-volume users have a streamlined sharing model that doesn’t rely on roles or groups, and functions similarly to calendar events and activities. High-volume users include the Customer Community, High Volume Customer Portal, and Authenticated Website license types.