# Sharing inheritance and security predicates for datasets

*CRM Analytics and Einstein Discovery Consultant Study Guide · Security · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/crm-analytics-and-einstein-discovery-consultant/security/sharing-inheritance-and-security-predicates-for-datasets*

When a dataset can inherit Salesforce sharing and when it needs a security predicate instead, how the backup predicate and coverage assessment work, valid predicate syntax, where to set row-level security for each dataset origin, and the leak and drift risks to plan for.

- Certification: Salesforce CRM Analytics and Einstein Discovery Consultant
- Exam section: Security
- Study guide: https://www.certifyforce.com/study-guide/crm-analytics-and-einstein-discovery-consultant

**Official exam objective:**

> Given row-based security requirements, implement the appropriate dataset security settings by using sharing inheritance and security predicates.

## What the exam expects

- Decide whether a dataset can inherit sharing (object, origin, output node, descriptors, audience) or needs a security predicate.
- Write the backup predicate and use the Sharing Inheritance Coverage Assessment to find uncovered users.
- Write valid predicates: quoting, spacing, operators, `$User` field types and the new-session rule.
- Set security in the right place for dataflows, recipes, CSV uploads and existing datasets, and fix a recipe and dataset mismatch.
- Spot leak and drift risks: calculated fields, computeRelative and delta, one sharing source, incremental sync.

Key terms: **sharing inheritance** (applies one Salesforce object's sharing to a dataset's rows); **sharing source** (the object a dataset inherits from); **security predicate** (a filter condition that defines row access); **backup predicate** (the predicate that decides rows for users inheritance doesn't cover); **sharing descriptor** (an ID of a user or group with access to a record).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Supported objects | Account, Case, Contact, Lead, Opportunity | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_limits.htm&type=5&language=en_US) |
| Per-record limit | Fewer than 400 sharing descriptors on every record | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_limits.htm&type=5&language=en_US) |
| Per-user coverage | View All Data or fewer than 3,000 descriptors; else HIGH_VISIBILITY | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_limits.htm&type=5&language=en_US) |
| Empty backup predicate | Same as false | [Data Prep Recipe](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_apply_to_recipe.htm&type=5&language=en_US) |
| Coverage assessment scope | Active users with Use CRM Analytics | [Determine If It Will Work](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_determine_will_work.htm&type=5&language=en_US) |
| CSV datasets | No sharing source | [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US) |
| Predicate length | 5,000 characters maximum | [Predicate Expression Syntax](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_syntax.htm&type=5&language=en_US) |
| `$User` field types | String, number, multivalue picklist; no boolean | [Values in a Predicate Expression](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_values.htm&language=en_US&type=5) |
| Range operators | Measure columns only | [Comparison Operators](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_operatorscomparison.htm&language=en_US&type=5) |
| Recipe or dataflow security change | Affects only datasets created afterwards | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_limits.htm&type=5&language=en_US) |
| Sharing-only record change | Reaches the dataset at the next full sync | [Security Metadata Drift](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_drift.htm&type=5&language=en_US) |

## Check yourself

- Which comparison operators work only with measure columns?
- Why does Help favour groups for granting access to inherited records?
- When does an invalid predicate surface as an error?
- How do you match a column against a multi-select picklist on User?
- What is the longest predicate expression allowed?

## Sources

- [Sharing Inheritance Limits and Considerations](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_limits.htm&type=5&language=en_US)
- [Add Row-Level Security by Inheriting Sharing Rules](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_about.htm&type=5&language=en_US)
- [Determine If Sharing Inheritance Will Work for You](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_determine_will_work.htm&type=5&language=en_US)
- [Enable Sharing Inheritance](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_getting_started.htm&language=en_US&type=5)
- [Set Sharing Inheritance for a Data Prep Recipe](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_apply_to_recipe.htm&type=5&language=en_US)
- [Set Sharing Inheritance for a Dataflow](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_applying_datasets.htm&type=5&language=en_US)
- [Add Row-Level Security with a Security Predicate](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_considerations.htm&type=5&language=en_US)
- [Predicate Expression Syntax for Datasets](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_syntax.htm&type=5&language=en_US)
- [Dataset Columns in a Predicate Expression](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_datasetcolumns.htm&language=en_US&type=5)
- [Values in a Predicate Expression](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_values.htm&language=en_US&type=5)
- [Comparison Operators](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_operatorscomparison.htm&language=en_US&type=5)
- [Logical Operators](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_operatorslogical.htm&language=en_US&type=5)
- [Security Metadata Drift](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_sharing_drift.htm&type=5&language=en_US)
- [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 22 linked practice questions, and unlimited timed mock exams are included with the CRM Analytics and Einstein Discovery Consultant pack (USD $19): https://www.certifyforce.com/practice-exams