# Sharing model and record access

*Platform Administrator Study Guide · Configuration and Setup · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/platform-administrator/configuration-and-setup/sharing-model-and-record-access*

How record access is built: org-wide defaults as the restrictive baseline, then the role hierarchy, public groups, owner- and criteria-based sharing rules, account and opportunity teams and manual sharing to open it up, restriction rules to narrow it, View All versus View All Data, and how folder access differs from record access.

- Certification: Salesforce Platform Administrator
- Exam section: Configuration and Setup
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator

**Official exam objective:**

> Given a user request scenario, apply the appropriate security controls based on the features and capabilities of the Salesforce sharing model (for example: Teams, Sharing hierarchy, public groups, org-wide defaults, sharing: roles, subordinates, role hierarchy, report and dashboard folders).

## What the exam expects

- Set org-wide defaults as the most restrictive baseline an object needs, knowing sharing features only add access and restriction rules are what narrows it.
- Predict what the role hierarchy grants managers, when it fails (users in the wrong role), and when to turn off Grant Access Using Hierarchies.
- Choose between a public group, a sharing rule (and its target), a team, and manual sharing for a given audience.
- Explain that folder access controls who can open a report, not which rows it returns.
- Tell View All Records on one object from View All Data.
- Recognise when a master-detail detail object can't have its own sharing.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Sharing features and the default | They only add access; none is stricter than the org-wide default | [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5) |
| Set org-wide defaults | Setup, Sharing Settings; Manage Sharing permission | [Org-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&type=5) |
| Account Private | Opportunity and Case must be Private; Contact Private or Controlled by Parent | [Org-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&type=5) |
| Detail object in master-detail | Controlled by Parent; not editable | [Org-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&type=5) |
| Grant Access Using Hierarchies | Can be deselected only for custom objects | [Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&type=5) |
| Role hierarchy | Users see records owned by or shared with roles below them | [Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&type=5) |
| Roles and Internal Subordinates | The role plus all internal roles below it | [Sharing Rule Categories](https://help.salesforce.com/s/articleView?id=platform.security_sharing_data_set_categories.htm&type=5) |
| Sharing rule limit | 300 per object, including up to 50 criteria-based | [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5) |
| Team member access | Can be greater than the org-wide default, never less | [Account Teams](https://help.salesforce.com/s/articleView?id=sales.accountteam_def.htm&type=5) |
| Manual share on owner change | Deleted by default | [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&type=5) |
| Restriction rules | Narrow sharing-granted access to records matching criteria | [Restriction Rules](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&type=5) |
| Restriction rules and View All | A View All Records/Data or Modify All Records/Data holder sees every record regardless of the rule | [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&type=5) |
| View All Records vs View All Data | One object vs every object; neither overrides field-level security | [View All and Modify All](https://help.salesforce.com/s/articleView?id=platform.users_profiles_view_all_mod_all.htm&type=5) |
| Folder access levels | Viewer, Editor, Manager | [Folder Access Levels](https://help.salesforce.com/s/articleView?id=analytics.analytics_folder_access.htm&language=en_US&type=5) |

## Check yourself

- Why must an org-wide default be the most restrictive level any user needs?
- What does a manager lose if a rep has no role assigned?
- On which objects can you turn off Grant Access Using Hierarchies, and on which can't you?
- When would you use a team or manual sharing instead of a sharing rule?
- What does Viewer access to a report folder allow, and what does it not change?

## Sources

- [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&type=5)
- [Controlling Access Using the Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&type=5)
- [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&type=5)
- [Sharing Rule Categories](https://help.salesforce.com/s/articleView?id=platform.security_sharing_data_set_categories.htm&type=5)
- [Public and Personal Groups](https://help.salesforce.com/s/articleView?id=platform.user_groups.htm&type=5)
- [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&type=5)
- [Considerations for Using Account Teams](https://help.salesforce.com/s/articleView?id=sales.accountteam_def.htm&type=5)
- [Access Levels for Report and Dashboard Folders](https://help.salesforce.com/s/articleView?id=analytics.analytics_folder_access.htm&language=en_US&type=5)
- [Troubleshoot Reports](https://help.salesforce.com/s/articleView?id=analytics.rd_reports_troubleshoot.htm&type=5)
- [Opportunity Teams and Opportunity Splits](https://help.salesforce.com/s/articleView?id=sales.teamselling.htm&type=5)
- [Restriction Rules](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&type=5)
- [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&type=5)
- [View All and Modify All Permissions Overview](https://help.salesforce.com/s/articleView?id=platform.users_profiles_view_all_mod_all.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator pack (USD $19): https://www.certifyforce.com/practice-exams