# Internal and external OWDs and restriction rules

*Platform Sharing and Visibility Architect Study Guide · Access to Records · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/access-to-records/internal-and-external-owds-and-restriction-rules*

How to pick the internal, external and guest organization-wide default for each object, which platform constraints lock or force a default, when a default change takes effect, and when a restriction rule or a scoping rule fits better than a tighter default.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Access to Records
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a set of conditions, recommend the appropriate organization-wide defaults to restrict access to records.

## What the exam expects

- Recommend the internal default per object from who must view, edit, transfer or delete records they don't own.
- Recommend a separate external default for authenticated external users, and explain why guest users stay Private.
- Recognise the constraints that force or lock a default.
- Predict when a default change takes effect.
- Choose between a tighter default, a restriction rule and a scoping rule.

Key terms: **OWD** (baseline access to records a user doesn't own); **external OWD** (a separate baseline for authenticated external users); **Controlled by Parent** (access follows the parent record); **sharing recalculation** (the job that applies access changes); **restriction rule** (hides records a user could otherwise reach); **scoping rule** (default focus that never restricts access).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Transfer level | Public Read/Write/Transfer: cases and leads only | [Organization-Wide Default Access Settings](https://help.salesforce.com/s/articleView?id=platform.sharing_model_fields.htm&language=en_US&type=5) |
| Private accounts | Opportunity and Case Private; Contact Private or Controlled by Parent | [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&language=en_US&type=5) |
| Apex share entries | Block a custom object's change from private to public | [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&language=en_US&type=5) |
| Deleted master-detail | Former detail reverts to Public Read/Write, hierarchies on | [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5) |
| External vs internal | External never more permissive than internal | [External Organization-Wide Defaults Overview](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&language=en_US&type=5) |
| Guest users | Private for all objects; can't be changed | [External Organization-Wide Defaults Overview](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&language=en_US&type=5) |
| Change timing | Increase: immediate; decrease: after recalculation | [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&language=en_US&type=5) |
| Restriction rule limit | 2 active per object (Enterprise, Developer); 5 (Performance, Unlimited) | [Restriction Rules](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&language=en_US&type=5) |

## Check yourself

- If Account is Private, which Contact defaults are allowed?
- Why would external users in an org created after Spring '20 start with no access to Campaign records when the internal default is Public Full Access?
- Why might a user with View All Records still see records a restriction rule should hide?
- When the User default is Private, whose user records can a user read?

## Sources

- [Control Access to External Object Records with Restriction Rules](https://help.salesforce.com/s/articleView?id=release-notes.rn_forcecom_sharing_restriction_rules_external_objects.htm&language=en_US&release=238&type=5)
- [Organization-Wide Default Access Settings](https://help.salesforce.com/s/articleView?id=platform.sharing_model_fields.htm&language=en_US&type=5)
- [Set Your Internal Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&language=en_US&type=5)
- [External Organization-Wide Defaults Overview](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&language=en_US&type=5)
- [Default Organization-Wide Access Levels](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_default_settings.htm&language=en_US&type=5)
- [Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&language=en_US&type=5)
- [Restriction Rules](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&language=en_US&type=5)
- [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&language=en_US&type=5)
- [Scoping Rules](https://help.salesforce.com/s/articleView?id=platform.security_scoping_rule.htm&language=en_US&type=5)
- [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5)
- [Platform Sharing Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/platform-sharing-architecture)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams