# Designing a least-privilege external security model

*Experience Cloud Consultant Study Guide · Sharing, Visibility, and Licensing · Last updated October 24, 2026 · https://www.certifyforce.com/study-guide/experience-cloud-consultant/sharing-visibility-and-licensing/designing-a-least-privilege-external-security-model*

How to design external access that grants only what each persona needs: one custom profile plus permission sets and groups, access-summary reviews, the oversharing paths through nested public groups and portal subordinates, Apex that guests can call, and targeted sharing when account role optimization is on.

- Certification: Salesforce Experience Cloud Consultant
- Exam section: Sharing, Visibility, and Licensing
- Study guide: https://www.certifyforce.com/study-guide/experience-cloud-consultant

**Official exam objective:**

> Given a scenario, determine a security model based on an Experience use case.

## What the exam expects

- Determine a security model for an Experience Cloud use case: custom external profiles, permission sets and permission set groups, site membership and a Private external default.
- Recommend how to review external access periodically and trace which feature grants a permission.
- Spot the oversharing paths: nested public groups that contain external users, sharing rules that use Roles, Internal and Portal Subordinates, and records visible up the external role hierarchy.
- Secure Apex that guests or external users reach from Lightning components on Aura and LWR sites.
- Choose targeted sharing when account role optimization (ARO) is on.

Key terms: **least privilege** (only the access and abilities required to complete the work); **access summary** (a user's or group's assigned permissions, groups and queues, with Access Granted By); **nested public group** (a group that contains another group); **targeted sharing** (sharing with a specific user or a group containing them, not with a role); **shared person role** (the one role ARO gives single-user accounts).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| External OWD | Keep Private where possible | [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5) |
| External profiles | Custom profiles, not the standard license profiles | [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5) |
| Persona differences | Permission sets and permission set groups, not more profiles | [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5) |
| Access review | Representative user's access summary, then Access Granted By | [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5) |
| Public groups | Can be nested; outer-group rules reach inner external members | [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5) |
| Convert External User Access Wizard | Older orgs: Roles, Internal, and Portal Subordinates becomes Roles and Internal Subordinates | [ARO Sharing Considerations](https://help.salesforce.com/s/articleView?id=sf.networks_partners_optimize_roles_considerations.htm&language=en_US&type=5) |
| Guest-callable @AuraEnabled Apex | with sharing, plus guest profile class access | [Guest User Profile Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5) |
| ARO sharing rules | Never target the shared person role | [ARO Sharing Considerations](https://help.salesforce.com/s/articleView?id=sf.networks_partners_optimize_roles_considerations.htm&language=en_US&type=5) |
| Partner roles | Roll up to the account owner, typically the channel manager | [Partner User Roles](https://help.salesforce.com/s/articleView?id=platform.networks_partner_roles_overview.htm&type=5&language=en_US) |

## Check yourself

- Why do persona differences belong in permission set groups rather than in extra cloned profiles?
- When can a sharing rule aimed at a seemingly internal public group still reach partners?
- What does an @AuraEnabled class that guests can run need on the class and on the guest profile?
- Why shouldn't a sharing rule target the shared person role under ARO?

## Sources

- [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5)
- [Sharing Considerations for Using Account Role Optimization in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=sf.networks_partners_optimize_roles_considerations.htm&language=en_US&type=5)
- [Best Practices and Considerations When Configuring the Guest User Profile](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5)
- [Control User Access to Your Experience Cloud Site Control](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.shr_control_user_access_to_your_experience_cloud_site.htm&type=5)
- [Partner User Roles](https://help.salesforce.com/s/articleView?id=platform.networks_partner_roles_overview.htm&type=5&language=en_US)
- [Give Secure Access to Unauthenticated Users with the Guest User Profile](https://help.salesforce.com/s/articleView?language=en_US&id=sf.networks_public_access.htm&type=5)
- [Experience Cloud User Licenses](https://help.salesforce.com/s/articleView?id=users_license_types_communities.htm&language=en_US&type=0)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Experience Cloud Consultant pack (USD $19): https://www.certifyforce.com/practice-exams