RestrictionRule

Represents a restriction rule or a scoping rule. A restriction rule has enforcementType set to Restrict and controls the access that specified users have to designated records. A scoping rule has enforcementType set to Scoping and controls the default records that your users see without restricting access.

This type extends Metadata and inherits its fields.

RestrictionRule components have the suffix .rule and are stored in the restrictionRules folder.

Introduced in API version 52.0.

Only users with the View Restriction and Scoping Rules permission can view restriction rules and scoping rules via the API. Only users with the Manage Sharing permission can view, create, update, and delete restriction rules and scoping rules.

• Type: boolean
• Required: Yes
• Description: Indicates whether the rule is active (true) or not (false). The default value is false.

• Type: string
• Required: No

• Type: string
• Required: No
• Description: Required. The description of the rule.

• Type: EnforcementType (enumeration of type string)
• Required: Yes
• Description: Required. The type of rule.
• Possible values:
  • FieldRestrict — Don’t use.
  • Restrict — Restriction rule.
  • Scoping — Scoping rule.

• Type: string
• Required: Yes
• Description: Required. The name of the rule.

• Type: string
• Required: Yes
• Description: Required. The criteria that determine which records are accessible via the rule.

• Type: string

• Required: Yes

• Description: Required. The object for which you’re creating the rule. We recommend that you don’t edit this field after the rule is created.

  If enforcementType is set to Restrict, custom objects, external objects, and these objects are supported:

  • Contract
  • Event
  • Quote
  • Task
  • TimeSheet
  • TimeSheetEntry

  If enforcementType is set to Scoping, custom objects and these objects are supported:

  • Account
  • Case
  • Contact
  • Event
  • Lead
  • Opportunity
  • Task

• Type: string
• Required: No
• Description: Required. The users that this rule applies to, such as all active users or users with a specified role or profile.

• Type: int
• Required: Yes
• Description: Required. The rule’s version number.

The following is an example of a RestrictionRule component representing a restriction rule.

1<?xml version="1.0" encoding="UTF-8"?>
2<RestrictionRule xmlns="http://soap.sforce.com/2006/04/metadata">
3    <active>true</active>
4    <description>Allows users with a specific profile to see only tasks that they own.</description>
5    <enforcementType>Restrict</enforcementType>
6    <masterLabel>Tasks You Own</masterLabel>
7    <recordFilter>OwnerId = $User.Id</recordFilter>
8    <targetEntity>Task</targetEntity>
9    <userCriteria>$User.ProfileId = '00exxxxxxxxxxxx'</userCriteria>
10    <version>1</version>
11</RestrictionRule>

The following is an example of a RestrictionRule component representing a scoping rule.

1<?xml version="1.0" encoding="UTF-8"?>
2<RestrictionRule xmlns="http://soap.sforce.com/2006/04/metadata">
3    <active>true</active>
4    <description>View tasks contacts from Department A.</description>
5    <enforcementType>Scoping</enforcementType>
6    <masterLabel>SR for Department A contacts</masterLabel>
7    <recordFilter>Department=$User.Department</recordFilter>
8    <targetEntity>Contact</targetEntity>
9    <userCriteria>$User.UserRoleId = '00Exxxxxxxxxxxx'</userCriteria>
10    <version>1</version>
11</RestrictionRule>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>RestrictionRule</name>
6    </types>
7    <version>55.0</version>
8</Package>