FieldRestrictionRule

Represents a field visibility rule that controls whether a field is visible to a user, based on the field’s inclusion in a field set. If Enhanced Personal Information Management setting was enabled before Spring ’22, field visibility is based on the field’s compliance categorization.

This type extends Metadata and inherits its fields.

FieldRestrictionRule components have the suffix .rule and are stored in the fieldRestrictionRules folder.

Introduced in API version 52.0.

• To access this type, you must have the Manage Sharing permission.
• To create and manage Employee field visibility rules, you must be assigned a Workplace Command Center permission set license and the Provides access to Workplace Command Center features system permission.
• To create and manage User field visibility rules, you must enable Digital Experiences and the Enhanced Personal Information Management feature.

• Type: boolean
• Required: Yes
• Description: Indicates whether the rule is active (true) or not (false). The default value is false.

• Type: string[]
• Required: No
• Description: Required. The data classification compliance categorization or field set that is targeted by the rule. The rule applies to fields that are marked with this categorization or included in this field set. If you enabled Enhanced Personal Information Management before Spring ‘22 (API version 54.0), you can use Salesforce’s default compliance categorization values or values that you add yourself. If you enabled Enhanced Personal Information Management after Spring ‘22 (API version 54.0), use the PersonalInfo_EPIM field set or a field set that you add yourself.

• Type: ClassificationType (enumeration of type string)
• Required: No
• Introduced: API version 54.0
• Description: The type of classification method used in your org. If you enabled Enhanced Personal Information Management before Spring ‘22 (API version 54.0), use ComplianceCategory. If you enabled Enhanced Personal Information Management after Spring ‘22, use FieldSet. The default value is ComplianceCategory.
• Possible values:
  • ComplianceCategory
  • FieldSet

• Type: string
• Required: No
• Description: Required. The description of the rule.

• Type: EnforcementType (enumeration of type string)
• Required: Yes
• Description: Required. The type of rule.
• Possible values:
  • FieldRestrict — Field visibility rule. Only this value is valid.
  • Restrict — Do not use.
  • Scoping — Do not use.

• Type: string
• Required: Yes
• Description: Required. The name of the rule.

• Type: string
• Required: Yes
• Description: Required. The criteria that determine which fields are visible to the specified users. For example, the field can check if the logged-in user matches the Employee’s ID.

• Type: string
• Required: Yes
• Description: Required. The object for which you’re creating the rule. Only the Employee and User objects are supported.

• Type: string
• Required: Yes
• Description: Required. The users that this rule applies to, such as all active users or users with a specified role or profile.

• Type: int
• Required: Yes
• Description: Required. The rule’s version number.

The following is an example of a FieldRestrictionRule component, which uses the ComplianceCategory classification type. The classification value is one of Salesforce’s default compliance categorization values, but you can create a custom compliance categorization value to use instead.

1<?xml version="1.0" encoding="UTF-8"?>
2<FieldRestrictionRule xmlns="http://soap.sforce.com/2006/04/metadata">
3    <active>true</active>
4    <classification>PII</classification>
5    <classificationType>ComplianceCategory</classificationType>
6    <description>Is Owner of Employee</description>
7    <enforcementType>FieldRestrict</enforcementType>
8    <masterLabel>Is Owner Field Restriction Rule</masterLabel>
9    <recordFilter>OwnerId = $User.Id</recordFilter>
10    <targetEntity>Employee</targetEntity>
11    <userCriteria>$User.IsActive = true</userCriteria>
12    <version>1</version>
13</FieldRestrictionRule>

The following is an example of a FieldRestrictionRule component, which uses the FieldSet classification type. The classification value is Salesforce’s default field set for personal information, but you can create a field set to use instead.

1<?xml version="1.0" encoding="UTF-8"?>
2<FieldRestrictionRule xmlns="http://soap.sforce.com/2006/04/metadata">
3    <active>true</active>
4    <classification>PersonalInfo_EPIM</classification>
5    <classificationType>FieldSet</classificationType>
6    <description>Is Owner of Employee</description>
7    <enforcementType>FieldRestrict</enforcementType>
8    <masterLabel>Is Owner Field Restriction Rule</masterLabel>
9    <recordFilter>OwnerId = $User.Id</recordFilter>
10    <targetEntity>Employee</targetEntity>
11    <userCriteria>$User.IsActive = true</userCriteria>
12    <version>1</version>
13</FieldRestrictionRule>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>FieldRestrictionRule</name>
6    </types>
7    <version>52.0</version>
8</Package>