# Sharing solutions: org-wide defaults, rules and teams

*Platform App Builder Study Guide · Salesforce Fundamentals · Last updated October 25, 2026 · https://www.certifyforce.com/study-guide/platform-app-builder/salesforce-fundamentals/sharing-solutions-org-wide-defaults-rules-and-teams*

Choose the record-sharing tool for a requirement: org-wide defaults as the locked-down baseline, the role hierarchy, owner- and criteria-based sharing rules, account teams and implicit sharing, manual sharing, and Apex managed sharing when declarative sharing runs out.

- Certification: Salesforce Platform App Builder
- Exam section: Salesforce Fundamentals
- Study guide: https://www.certifyforce.com/study-guide/platform-app-builder

**Official exam objective:**

> Given a set of business requirements, determine the appropriate sharing solution.

## What the exam expects

- Set org-wide defaults to the most restrictive access any user needs, then open access with other tools.
- Choose between the role hierarchy, owner-based and criteria-based sharing rules, account teams, manual sharing and Apex managed sharing for a requirement.
- Predict sharing-rule behaviour: queue sources, supported criteria fields, case-sensitive text, Share with fixed after save, converted leads.
- Explain implicit sharing between accounts and their opportunities, cases and contacts.
- Key terms: **org-wide default** (baseline access to records a user doesn't own); **sharing rule** (automatic exception that grants more access to a group, role or territory); **implicit sharing** (system-maintained parent and child account access); **manual share** (one-off share of a single record); **Apex managed sharing** (code that shares custom object records).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Defaults and other tools | Other features only add access above the default | [Organization-Wide Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm) |
| Defaults that allow sharing rules | Public Read Only or Private | [Sharing Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&type=5) |
| Rules per object | 300 total, up to 50 criteria-based or guest user | [Sharing Rules](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_about_sharing_rules.htm&type=5) |
| Text criteria | Case-sensitive; comma-separate variants | [Sharing Rule Types](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_sharing_rule_types.htm&type=5) |
| Fields not allowed in criteria | Encrypted, formula, derived values, and lookups other than to a user or queue ID | [Sharing Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&type=5) |
| Queue as rule source | Shares only queue-owned records | [Sharing Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&type=5) |
| Custom objects and hierarchy | Grant Access Using Hierarchies must be selected | [Sharing Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&type=5) |
| Team member access | Equal to or higher than the default, never lower | [Account Teams](https://help.salesforce.com/s/articleView?id=sf.accountteam_def.htm&type=5) |
| Parent implicit sharing | Read-only access to the parent account | [Implicit Sharing](https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_object_relationships_implicit_sharing.htm) |
| Manual shares on owner change | Deleted unless Keep manual shares when transferring records is on | [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&type=5) |

## Check yourself

- Why must the org-wide default be the most restrictive level any user needs?
- When do managers above a custom object record's owner not inherit access granted by sharing rules?
- Why do marketers lose access to records created from leads they could see through a lead sharing rule?
- What happens to manual shares when a record's owner changes?

## Sources

- [Control Who Sees What](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_data_access.htm&type=5)
- [Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm)
- [Sharing Rules](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_about_sharing_rules.htm&type=5)
- [Sharing Rule Types](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_sharing_rule_types.htm&type=5)
- [Sharing Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&type=5)
- [Considerations for Using Account Teams](https://help.salesforce.com/s/articleView?id=sf.accountteam_def.htm&type=5)
- [Implicit Sharing](https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_object_relationships_implicit_sharing.htm)
- [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the Platform App Builder pack (USD $19): https://www.certifyforce.com/practice-exams