HELLO Salesforce Thinkers, In our previous blog we learned about Salesforce Data Security and Access – Part 7 (Permission sets) In this blog we are going to learn about “Record Level Access (OWD)”. We will continue our learning journey by a series of blogs to go deeper and understand the Salesforce Data Security Model, Visibility and Access.

Record access determines which individual records users can view and edit in each object they have access to in their profile.

The permissions on a record are always evaluated according to a combination of object-level, field-level, and record-level permissions.

There are 4 different mechanisms that control record-level sharing among different sets of users.

1. Organization-wide defaults
2. Role hierarchy
3. Sharing rules
4. Manual sharing and team sharing

Let’s understand them one by one , In this blog we will learn about Organization-wide defaults.

Organization-wide defaults :

Objects permissions (Create, Read, Edit, Delete) control what users can do with records they own.

The Organization-wide default (OWD) defines the level of access each user has for records for a particular object. OWD provides the baseline-level access that the most restricted user should have.

We can use org-wide defaults to lock down our data, and then use the other record-level security and sharing tools (role hierarchies, sharing rules, and manual sharing) to open up the data to users who need it.

Org-wide sharing settings can be set separately for each type of object (Standard Objects and Custom).

Object permissions determine the baseline level of access for all the records in an object. Org-wide defaults modify those permissions for records a users doesn’t own. 

Note :

Org-wide defaults can never grant users more access than they have through their object permission granted in the user profile.

Let’s understand the sharing models which implement the organization-wide default settings.

Public Read/Write:
All users can view, edit, and report on all records.

Public Read Only:
All users can view and report on records but not edit them. Only the owner, and users above that role in the hierarchy, can edit those records.

Private: Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records.

Controlled by Parent: A user can perform an action (such as view, edit, or delete) on a contact based on whether he or she can perform that same action on the record associated with it.

Public Read/Write Transfer:  All users can view, edit, transfer, and report on all records. Only available for cases or leads.

Only available for campaigns:

Public Full Access: All users can view, edit, transfer, delete, and report on all records.

Access levels for the campaign OWD can be set to private, Public Read only, Public Read/Write and Public Full Access. When campaign object is set to public full access, all users in that organization can be able to view, edit, transfer and delete.

Additionally we have some more sharing models according to the different objects:

Options available only for Price books:

No Access, View only, Use:

This No Access, View only, Use options is available only for Price books only. We can set access level for price book OWD settings to either No Access, view only or use.

• Use is default access level for price Book and allows the users to access the price book information and can use that price book information in opportunities with products
• View Only allows the users to access the price book information and but not to use that price book information in opportunities with products.
• No Access restricts the users to access price book information and prices.

How to set Org-Wide Sharing Defaults?

Navigate to

Setup >> Sharing Settings

Click Edit in the Organization-Wide Defaults area.

For example, select Private access to student object.

Click Save.

Points to Remember:

• Changing OWD settings and increasing default access ex: From Public Read Only to Public Read/Write will take effect immediately.
• Changing OWD settings and decreasing default access in an existing organization with significant data will take some time for salesforce to recalculate user access.
• If a custom object is on the detail side of a master-detail relationship with a standard object, the OWD setting will be ‘Controlled by Parent’ and can not be changed.

Thank you for reading, Hope the blog is helpful.