Salesforce structures data into three key elements - objects, fields, and records - and layers security on top of each. Objects are like tables, fields like columns, and records like individual rows. Access is controlled at all three levels.
The basics: objects, fields & records
Before diving into the layers, it helps to map the vocabulary. Salesforce employs object-level, field-level, and record-level security to control access at each of these fundamental levels.
Objects
Akin to tables in a database - Accounts, Contacts, Opportunities, and custom objects.
Fields
Resemble columns - the individual attributes captured on each object.
Records
Individual rows of data - a single Account or Opportunity owned by a user.
Meet Maria: a sales executive at ABC Corp. We'll trace how each layer decides what she can see and do - from which objects she opens, to which fields she reads, to which records belong to her.
Layer 1: object-level security
Before granting access, Salesforce validates a user's permission to view objects of a specific type. Object-level access is managed through profiles and permission sets.
Profiles
Traditionally used for controlling access, profiles define object and field permissions. However, it's now recommended to use permission sets and permission set groups for configuring object and field permissions.
Permission sets & permission set groups
Permission sets offer greater flexibility, packaging, and upgradeability, allowing a more granular approach to organizing functionality. Permission set groups simplify management by grouping multiple permission sets into one - streamlining assignment for users like Maria.
Layer 2: field-level security
Even with object-level access, users like Maria need access to individual fields within objects. Profiles and permission sets also govern field-level access - so a user might open an Opportunity yet not see its sensitive amount or margin fields.
Layer 3: record-level security
Object- and field-level access only go so far. Record-level security - often called the Salesforce sharing model - controls access to records owned by different users. There are five mechanisms:
- Organization-wide defaults (OWD). Set the baseline access for all records of an object - from Private to Public Read/Write - affecting who can view, edit, or delete.
- Role hierarchies. Mirror the org chart so users in higher roles get access to records owned by users below them.
- Sharing rules. Open access laterally - ownership-based and criteria-based rules share by role, group, or field criteria.
- Manual sharing. Lets end-users share an individual record directly - useful when OWD is Private or Public Read-Only.
- Apex managed sharing. When UI and settings fall short, Apex code automates sharing for complex, custom scenarios.
Order of operations: OWD locks records down first, then role hierarchy, sharing rules, manual sharing, and Apex sharing progressively open access back up - they grant, never restrict.
Summary
Salesforce's data security model operates on three layers, providing unparalleled flexibility for diverse business needs. Profiles and permission sets control object and field access - with permission sets being the recommended tool. The five types of record-level security work together to ensure data access is precisely tailored to each organization's structure and workflows.
Locking down your Salesforce org?
Our Salesforce-native team designs clean permission-set architectures and sharing models that scale - across finance, healthcare, manufacturing, and aviation. Let's get your access model right.
Talk to an Engineer