# Object permissions, field-level security and restriction rules

*Platform App Builder Study Guide · Salesforce Fundamentals · Last updated October 25, 2026 · https://www.certifyforce.com/study-guide/platform-app-builder/salesforce-fundamentals/object-permissions-field-level-security-and-restriction-rules*

How object permissions, View All and Modify All, field-level security, permission sets, permission set groups with muting, restriction rules and user licenses combine to extend or restrict what a user can reach.

- Certification: Salesforce Platform App Builder
- Exam section: Salesforce Fundamentals
- Study guide: https://www.certifyforce.com/study-guide/platform-app-builder

**Official exam objective:**

> Apply features and capabilities available to restrict and extend object, record, and field access.

## What the exam expects

- Choose object permissions, including View All Records or Modify All Records over View All Data, and know which override sharing.
- Predict field access from field-level security plus the page layout, and secure formula fields that expose hidden data.
- Combine profiles, permission sets and permission set groups, and use a muting permission set to remove a permission from a group.
- Use a restriction rule to narrow records users can already see, and name what bypasses it.
- Choose a user license for a custom app and recognize licenses as the ceiling of what permissions can grant.
- Key terms: **object permissions** (base create, read, edit, delete access per object); **field-level security** (view or edit access per field); **permission set group** (bundle of permission sets for a persona); **muting permission set** (removes selected permissions inside one group); **restriction rule** (filter on records a user already has access to).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Permissions that override sharing | View All Records and Modify All Records only | [Object Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm) |
| View All / Modify All and FLS | None of them overrides field-level security | [View All and Modify All](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_view_all_mod_all.htm&type=5) |
| View All Records and children | Reaches child custom objects, not standard detail objects | [View All and Modify All](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_view_all_mod_all.htm&type=5) |
| Layout plus FLS | Most restrictive setting applies | [Field Permissions](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_field_perms.htm&type=5) |
| Formula and roll-up fields | Can show data from fields the user can't see | [Field Permissions](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_field_perms.htm&type=5) |
| Muting | One muting permission set per group; affects only that group's grants | [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5) |
| Restriction rule limits | 2 active per object (Enterprise, Developer), 5 (Performance, Unlimited) | [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&type=5) |
| Platform Starter vs Plus | 10 vs 110 custom objects per license; no leads, opportunities or campaigns | [Platform Starter and Plus features](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_license_types_communities_lightning_platform_details.htm&type=5) |
| Restriction rule bypass | View All Records, View All Data, Modify All Records, Modify All Data | [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&type=5) |

## Check yourself

- Why is View All Records usually better than View All Data for an auditor of one object?
- When does a user with View All Records on Account still miss some related cases?
- Which comparison operator can restriction rule criteria use?
- Why can't a permission set alone give a Platform-licensed user access to opportunities?

## Sources

- [Object Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm)
- ["View All" and "Modify All" Permissions Overview](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_view_all_mod_all.htm&type=5)
- [Field Permissions](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_profiles_field_perms.htm&type=5)
- [Permission Sets](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_sets_overview.htm)
- [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5)
- [Muting Permission Sets in Permission Set Groups](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5)
- [Restriction Rules](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&type=5)
- [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&type=5)
- [Standard User Licenses](https://help.salesforce.com/s/articleView?id=platform.users_license_types_available.htm&type=5)
- [Permission Set Licenses](https://help.salesforce.com/s/articleView?id=platform.users_permissionset_licenses_overview.htm&type=5)
- [Features Available with Lightning Platform Starter, Lightning Platform Plus, and Salesforce Platform Login Licenses](https://help.salesforce.com/s/articleView?language=en_US&id=platform.users_license_types_communities_lightning_platform_details.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 16 linked practice questions, and unlimited timed mock exams are included with the Platform App Builder pack (USD $19): https://www.certifyforce.com/practice-exams