# Data visibility: org-wide defaults to sharing rules

*Platform Foundations Study Guide · Data Model · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/platform-foundations/data-model/data-visibility-org-wide-defaults-to-sharing-rules*

The four levels of Salesforce data access and the feature for each: login limits for the org, profiles and permission sets for objects, field-level security for fields, and org-wide defaults, the role hierarchy, sharing rules and manual sharing for records.

- Certification: Salesforce Platform Foundations
- Exam section: Data Model
- Study guide: https://www.certifyforce.com/study-guide/platform-foundations

**Official exam objective:**

> Given a scenario, determine which feature to use to ensure data visibility.

## What the exam expects

- Place a requirement at the right level of data access: organization, object, field or record.
- Choose between profiles and permission sets to give users what they can do with an object.
- Use field-level security, not page layouts, to hide or lock a field everywhere.
- Pick an org-wide default, then the role hierarchy, a sharing rule or manual sharing to open record access.
- Explain why sharing rules can't take access away and why detail records have no sharing setting of their own.

Key terms:
- **Object permissions:** whether a user can create, read, edit or delete records of an object.
- **Field-level security:** whether a user can see and edit a particular field.
- **Org-wide default (OWD):** the baseline access users have to records they don't own.
- **Role hierarchy:** gives users higher up access to records owned by users below them.
- **Sharing rule:** an automatic exception to the OWD for a group of users.
- **Manual sharing:** a one-record share, made with the Share button.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Login hours and locations | Set at the organization level | [Overview of Data Security](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_overview) |
| Profiles per user | Exactly one profile; permission sets can be several | [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&language=en_US&type=5) |
| Recommended permission model | Minimum Access - Salesforce profile plus permission sets and permission set groups | [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US&type=5) |
| Page layout vs field-level security | Layouts hide fields only on detail and edit pages; field permissions apply everywhere | [Control Access to Fields](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_fields) |
| Common OWD settings | Private, Public Read Only, Public Read/Write, Controlled by Parent | [Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&language=en_US&type=5) |
| OWD scope | Per object, and separately for internal and external users | [Control Access to Records](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_records) |
| OWD vs object permissions | An OWD can never grant more than the object permission | [Control Access to Records](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_records) |
| Detail object in master-detail | Inherits the parent's sharing setting; you can't set its OWD | [Control Access to Records](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_records) |
| Sharing rules and the role hierarchy | Only grant extra access, never restrict below the OWD | [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&language=en_US&type=5) |
| Who can manually share | Record owner, users above the owner, Modify All Records users, admins | [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&language=en_US&type=5) |

## Check yourself

- Why can't an org-wide default give a user edit access to an object they have only Read permission on?
- When is manual sharing the right tool?
- Why does a detail object have no org-wide default to choose?
- Which setting shows a field's value but stops the user from changing it?

## Sources

- [Overview of Data Security](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_overview)
- [Control Access to Records](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_records)
- [Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&language=en_US&type=5)
- [Control Access to Fields](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_fields)
- [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&language=en_US&type=5)
- [Manual Sharing](https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&language=en_US&type=5)
- [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US&type=5)
- [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Foundations pack (USD $19): https://www.certifyforce.com/practice-exams