Sales security model: sharing, teams and permissions
Pick the right access tool for a sales requirement: a restrictive org-wide default opened by the role hierarchy, owner- and criteria-based sharing rules, Account Teams and Opportunity Teams (with default teams), object-level View All for least privilege, and permission sets, permission set groups and muting for object permissions.
Given a set of business requirements, identify the appropriate security model (sharing rules, role hierarchy, Account Teams, Opportunity Teams, permission sets, permission set groups).
~8 min read · 22 practice questions ·
What the exam expects
- Set the org-wide default to the most restrictive level the requirement needs, then open access with the role hierarchy, sharing rules or teams.
- Choose owner-based or criteria-based sharing rules, Account Teams or Opportunity Teams (including default teams) from who needs access and for how long.
- Pick the least-privilege option: object-level View All instead of View All Data, a permission set instead of a cloned profile.
- Bundle permission sets into permission set groups by job function and remove one permission with a muting permission set.
Key terms: org-wide default (OWD) (baseline record access for an object); sharing rule (automatic exception that grants more access to groups, roles or territories); account team / opportunity team (named users with per-record access levels); permission set group (permission sets bundled by job function); muting permission set (disables selected permissions inside one group).
Key facts
- Detail
- 300 per object, including up to 50 criteria-based or guest user rules
- Detail
- Never stricter than the OWD; only grants more
- Detail
- Can be disabled for custom objects only
- Detail
- Gets Read on the related account
- Detail
- Removing account access removes related opportunity team memberships
- Detail
- Read, Edit or All per member
- Detail
- Read or Edit, higher than the OWD
- Detail
- Ignores sharing for one object; View All Data covers all
- Detail
- Affects only the group, not its permission sets
Sources for this section (7)
- Sharing Ruleshelp.salesforce.com (opens in a new tab)
- Role Hierarchyhelp.salesforce.com (opens in a new tab)
- Account Teamshelp.salesforce.com (opens in a new tab)
- OpportunityTeamMemberdeveloper.salesforce.com (opens in a new tab)
- UserTeamMemberdeveloper.salesforce.com (opens in a new tab)
- View All and Modify Allhelp.salesforce.com (opens in a new tab)
- Mute a Permissionhelp.salesforce.com (opens in a new tab)
- Why can't a sharing rule fix an OWD that is too open?
- When is an Opportunity Team better than an Account Team?
- Why prefer View All on Opportunity over View All Data for an analyst?
- What happens to groups when a shared permission set changes?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Agentforce Sales Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 20 lessons of the Agentforce Sales Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (22 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams