# Role hierarchy and Grant Access Using Hierarchies

*Platform Sharing and Visibility Architect Study Guide · Access to Records · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/access-to-records/role-hierarchy-and-grant-access-using-hierarchies*

How the role hierarchy opens access upward at the subordinate's level, when Grant Access Using Hierarchies can be turned off, what role access fields give account owners, how to design branches and role counts, and which role sharing groups a sharing rule can target.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Access to Records
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a set of conditions, recommend a solution that leverages the role hierarchy to support the record access requirements.

## What the exam expects

- Predict who above a user gains access to a record the user owns or was shared, and at what level.
- Decide when to deselect Grant Access Using Hierarchies, and who still sees the records afterwards.
- Explain the Opportunity, Case and Contact Access role fields and what happens to an account owner without a role.
- Design branches, the top of the hierarchy and the role count from current access needs.
- Pick the right role sharing group as a sharing-rule target, and tell roles from territories.

Key terms: **role hierarchy** (roles that open access upward); **Grant Access Using Hierarchies** (the per-object switch for that access); **role sharing group** (a system group per role); **branch** (a sub-tree that segregates a unit); **shared person role** (the one role Account Role Optimization gives a lone external user).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Level inherited | Same as the subordinate's on standard objects | [Platform Sharing Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/platform-sharing-architecture) |
| Grant Access Using Hierarchies | Editable for custom objects only | [Controlling Access Using the Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&language=en_US&type=5) |
| Setting off | Group Member still gains; Manager of Group Member doesn't | [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5) |
| Owner without a role | Contacts Read/Write; opportunities and cases No Access | [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5) |
| Contact Access field | Hidden when Contact is Public Read/Write or Controlled by Parent | [Role Fields](https://help.salesforce.com/s/articleView?id=sf.user_role_fields.htm&language=en_US&type=5) |
| Role limits | 5,000 (Spring '21 or later); 500 before, raisable by Support | [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5) |
| Role and Subordinates | Deprecated group | [Role and Territory Sharing Groups](https://help.salesforce.com/s/articleView?id=platform.users_role_terr_sharing_groups.htm&language=en_US&type=5) |

## Check yourself

- When do users above a subordinate not gain access to a record shared with the subordinate?
- Why would a role's edit page show no Case Access field?
- Why should a new sharing rule avoid the Role and Subordinates group?
- Which hierarchy shape keeps peers in one role from seeing each other yet lets a parent role see all?

## Sources

- [Controlling Access Using the Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&language=en_US&type=5)
- [Guidelines for Success with Roles](https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&language=en_US&type=5)
- [Platform Sharing Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/platform-sharing-architecture)
- [Role and Territory Sharing Groups](https://help.salesforce.com/s/articleView?id=platform.users_role_terr_sharing_groups.htm&language=en_US&type=5)
- [Role Fields](https://help.salesforce.com/s/articleView?id=sf.user_role_fields.htm&language=en_US&type=5)
- [Optimizing Salesforce Role Hierarchies for Data Security (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_roles)
- [Optimize Account Roles to Improve Performance and Scale](https://help.salesforce.com/s/articleView?id=platform.networks_partners_optimize_roles.htm&language=en_US&type=5)
- [Organization-Wide Default Access Settings](https://help.salesforce.com/s/articleView?id=platform.sharing_model_fields.htm&language=en_US&type=5)
- [Enterprise Territory Management Is Now Sales Territories](https://help.salesforce.com/s/articleView?id=release-notes.rn_sales_spm_etm_to_sales_territories.htm&language=en_US&release=250&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams