salesforce_security_impl_guide

Securing and Sharing Data
Sharing Rule Considerations
Sharing Rule Considerations
Sharing rules allow you to selectively grant data access to defined sets of users. Review the following
notes before using sharing rules:
Granting Access
• You can use sharing rules to grant wider access to data. You cannot restrict access below
your organization-wide default levels.
• If multiple sharing rules give a user different levels of access to a record, the user gets the
most permissive access level.
• Sharing rules automatically grant additional access to related records. For example,
opportunity sharing rules give role or group members access to the account associated
with the shared opportunity if they do not already have it. Likewise, contact and case sharing
rules provide the role or group members with access to the associated account as well.
• Users in the role hierarchy are automatically granted the same access that users below
them in the hierarchy have from a sharing rule, provided that the object is a standard object
or the Grant Access Using Hierarchies option is selected.
• Regardless of sharing rules, users can, at a minimum, view the accounts in their territories.
Also, users can be granted access to view and edit the contacts, opportunities, and cases
associated with their territories’ accounts.
Updating
• Creating an owner-based sharing rule with the same source and target groups as an existing
rule overwrites the existing rule.
• Once a sharing rule has been saved, you can’t change the Share with field settings
when you edit the sharing rule.
• Sharing rules apply to all new and existing records that meet the definition of the source data set.
• Sharing rules apply to both active and inactive users.
EDITIONS
Account and contact sharing
rules are available in:
Professional, Enterprise,
Performance, Unlimited,
and Developer Editions
Account territory, case, lead,
opportunity, and custom
object sharing rules are
available in: Enterprise,
Performance, Unlimited,
and Developer Editions
Campaign sharing rules are
available in Professional
Edition for an additional cost,
and Enterprise,
Performance, Unlimited,
and Developer Editions
Only custom object sharing
rules are available in
Database.com
• When you change the access levels for a sharing rule, all existing records are automatically updated to reflect the new access
levels.
• When you delete a sharing rule, the sharing access created by that rule is automatically removed.
• When you modify which users are in a group, role, or territory, the sharing rules are reevaluated to add or remove access as
necessary.
• When you transfer records from one user to another, the sharing rules are reevaluated to add or remove access to the transferred
records as necessary.
• Making changes to sharing rules may require changing a large number of records at once. To process these changes efficiently,
your request may be queued and you may receive an email notification when the process has completed.
• Lead sharing rules do not automatically grant access to lead information after leads are converted into account, contact, and
opportunity records.
Portal Users
• You can create rules to share records between most types of Customer Portal users and Salesforce users. Similarly, you can create
sharing rules between Customer Portal users from different accounts as long as they have the Customer Portal Manager user
license. However, you can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public
groups.
67