# Sales security model: sharing, teams and permissions

*Agentforce Sales Consultant Study Guide · Practical Application of Agentforce Sales Expertise · Last updated October 15, 2026 · https://www.certifyforce.com/study-guide/agentforce-sales-consultant/practical-application-of-agentforce-sales-expertise/sales-security-model-sharing-teams-and-permissions*

Pick the right access tool for a sales requirement: a restrictive org-wide default opened by the role hierarchy, owner- and criteria-based sharing rules, Account Teams and Opportunity Teams (with default teams), object-level View All for least privilege, and permission sets, permission set groups and muting for object permissions.

- Certification: Salesforce Agentforce Sales Consultant
- Exam section: Practical Application of Agentforce Sales Expertise
- Study guide: https://www.certifyforce.com/study-guide/agentforce-sales-consultant

**Official exam objective:**

> Given a set of business requirements, identify the appropriate security model (sharing rules, role hierarchy, Account Teams, Opportunity Teams, permission sets, permission set groups).

## What the exam expects

- Set the org-wide default to the most restrictive level the requirement needs, then open access with the role hierarchy, sharing rules or teams.
- Choose owner-based or criteria-based sharing rules, Account Teams or Opportunity Teams (including default teams) from who needs access and for how long.
- Pick the least-privilege option: object-level View All instead of View All Data, a permission set instead of a cloned profile.
- Bundle permission sets into permission set groups by job function and remove one permission with a muting permission set.

Key terms: **org-wide default (OWD)** (baseline record access for an object); **sharing rule** (automatic exception that grants more access to groups, roles or territories); **account team / opportunity team** (named users with per-record access levels); **permission set group** (permission sets bundled by job function); **muting permission set** (disables selected permissions inside one group).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Sharing rule limit | 300 per object, including up to 50 criteria-based or guest user rules | [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5) |
| Sharing rule direction | Never stricter than the OWD; only grants more | [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5) |
| Grant Access Using Hierarchies | Can be disabled for custom objects only | [Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&type=5) |
| Opportunity team member, Private OWDs | Gets Read on the related account | [Account Teams](https://help.salesforce.com/s/articleView?id=sales.accountteam_def.htm&type=5) |
| Account team removal | Removing account access removes related opportunity team memberships | [Account Teams](https://help.salesforce.com/s/articleView?id=sales.accountteam_def.htm&type=5) |
| Opportunity team access | Read, Edit or All per member | [OpportunityTeamMember](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_opportunityteammember.htm) |
| Default opportunity team | Read or Edit, higher than the OWD | [UserTeamMember](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_userteammember.htm) |
| View All | Ignores sharing for one object; View All Data covers all | [View All and Modify All](https://help.salesforce.com/s/articleView?id=platform.users_profiles_view_all_mod_all.htm&type=5) |
| Muting | Affects only the group, not its permission sets | [Mute a Permission](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5) |

## Check yourself

- Why can't a sharing rule fix an OWD that is too open?
- When is an Opportunity Team better than an Account Team?
- Why prefer View All on Opportunity over View All Data for an analyst?
- What happens to groups when a shared permission set changes?

## Sources

- [Improve Record Access Control in Your Org](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_records)
- [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&type=5)
- [Controlling Access Using the Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&type=5)
- [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5)
- [Improve Data Security with Sharing Rules](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_sharing_rules)
- [Considerations for Using Account Teams](https://help.salesforce.com/s/articleView?id=sales.accountteam_def.htm&type=5)
- [Set Up and Manage a Default Account Team](https://help.salesforce.com/s/articleView?id=sales.accountteam_default.htm&type=5)
- [Turn on Opportunity Teams](https://help.salesforce.com/s/articleView?id=sales.teamselling_enabling.htm&type=5)
- [OpportunityTeamMember (Object Reference)](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_opportunityteammember.htm)
- [UserTeamMember (Object Reference)](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_userteammember.htm)
- [View All and Modify All Permissions Overview](https://help.salesforce.com/s/articleView?id=platform.users_profiles_view_all_mod_all.htm&type=5)
- [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5)
- [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5)
- [Mute a Permission in a Permission Set Group](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 22 linked practice questions, and unlimited timed mock exams are included with the Agentforce Sales Consultant pack (USD $19): https://www.certifyforce.com/practice-exams