# Knowledge data categories and CRM Analytics security

*Platform Sharing and Visibility Architect Study Guide · Access to Other Data · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/access-to-other-data/knowledge-data-categories-and-crm-analytics-security*

Control Knowledge article access with data category visibility (roles, permission sets and profiles combined with OR, role inheritance, category families) or with standard sharing, and secure CRM Analytics with app sharing, security predicates and sharing inheritance, including its object, descriptor, join and Experience Cloud limits.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Access to Other Data
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a scenario, determine the appropriate access control needed to grant access to data that is not standard or custom objects.

## What the exam expects

- Predict which Knowledge articles a user sees from data category visibility on roles, permission sets, permission set groups and profiles.
- Explain role inheritance of category visibility and why a child role can't exceed its parent.
- Contrast data-category access control with standard sharing for Lightning Knowledge.
- Choose app sharing, a security predicate or sharing inheritance to secure CRM Analytics data, and name the inheritance limits.

Key terms: **data category visibility** (All, None or Custom categories per category group); **standard sharing for Knowledge** (OWD, ownership and rules on article versions); **security predicate** (a filter condition defining dataset row access); **sharing inheritance** (a dataset reuses one Salesforce object's sharing); **sharing descriptor** (one source of record access, such as ownership or a rule).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Visibility sources | Roles, permission sets, permission set groups, profiles; combined with OR | [Data Category Visibility](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=category_visibility_whatis.htm) |
| Child role | Can reduce, can't exceed parent visibility | [Data Category Visibility](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=category_visibility_whatis.htm) |
| Multi-group article | Needs one visible category in each group | [Data Category Visibility](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=category_visibility_whatis.htm) |
| Standard sharing level | Article version (Knowledge__kav) | [Knowledge Sharing Considerations](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.knowledge_sharing_considerations.htm) |
| Knowledge sharing gaps | No manual or Apex sharing | [Knowledge Sharing Considerations](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.knowledge_sharing_considerations.htm) |
| Dataset with no row security | Every user with dataset access sees all rows | [Security Predicate](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=analytics.bi_security_datasets_predicate_considerations.htm) |
| Inheritance objects | Account, Case, Contact, Lead, Opportunity | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=sf.bi_security_datasets_sharing_limits.htm&language=en_US&type=5) |
| User coverage | View All Data or fewer than 3,000 descriptors | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=sf.bi_security_datasets_sharing_limits.htm&language=en_US&type=5) |
| Experience Cloud users | No inheritance; use predicates | [Sharing Inheritance Limits](https://help.salesforce.com/s/articleView?id=sf.bi_security_datasets_sharing_limits.htm&language=en_US&type=5) |
| App share levels | Viewer, Editor, Manager to users, groups, roles | [Share an App](https://help.salesforce.com/s/articleView?id=sf.bi_app_share.htm&language=en_US&type=5) |

## Check yourself

- Why can a user see an article in a category her role hides?
- When can two versions of the same Knowledge article have different access?
- Why does a dataset that inherits sharing need a backup security predicate?
- What does a dataset loaded from a CSV show to every user who can open it?

## Sources

- [Data Category Visibility](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=category_visibility_whatis.htm)
- [Sharing Considerations for Lightning Knowledge](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.knowledge_sharing_considerations.htm)
- [Set Up Dataset Security to Control Access to Rows](https://help.salesforce.com/s/articleView?id=sf.bi_security_datasets_row_level.htm&language=en_US&type=5)
- [Add Row-Level Security with a Security Predicate](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=analytics.bi_security_datasets_predicate_considerations.htm)
- [Sharing Inheritance Limits and Considerations](https://help.salesforce.com/s/articleView?id=sf.bi_security_datasets_sharing_limits.htm&language=en_US&type=5)
- [Add Row-Level Security by Inheriting Sharing Rules](https://help.salesforce.com/s/articleView?id=bi_security_datasets_sharing_about.htm&language=en_US&type=5)
- [Share an App](https://help.salesforce.com/s/articleView?id=sf.bi_app_share.htm&language=en_US&type=5)
- [Platform Sharing Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/platform-sharing-architecture)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams