Sharing inheritance and security predicates for datasets
When a dataset can inherit Salesforce sharing and when it needs a security predicate instead, how the backup predicate and coverage assessment work, valid predicate syntax, where to set row-level security for each dataset origin, and the leak and drift risks to plan for.
Given row-based security requirements, implement the appropriate dataset security settings by using sharing inheritance and security predicates.
~7 min read · 22 practice questions ·
What the exam expects
- Decide whether a dataset can inherit sharing (object, origin, output node, descriptors, audience) or needs a security predicate.
- Write the backup predicate and use the Sharing Inheritance Coverage Assessment to find uncovered users.
- Write valid predicates: quoting, spacing, operators,
$Userfield types and the new-session rule. - Set security in the right place for dataflows, recipes, CSV uploads and existing datasets, and fix a recipe and dataset mismatch.
- Spot leak and drift risks: calculated fields, computeRelative and delta, one sharing source, incremental sync.
Key terms: sharing inheritance (applies one Salesforce object's sharing to a dataset's rows); sharing source (the object a dataset inherits from); security predicate (a filter condition that defines row access); backup predicate (the predicate that decides rows for users inheritance doesn't cover); sharing descriptor (an ID of a user or group with access to a record).
Key facts
- Detail
- Account, Case, Contact, Lead, Opportunity
- Detail
- Fewer than 400 sharing descriptors on every record
- Detail
- View All Data or fewer than 3,000 descriptors; else HIGH_VISIBILITY
- Detail
- Same as false
- Detail
- Active users with Use CRM Analytics
- Detail
- No sharing source
- Detail
- 5,000 characters maximum
$User field types- Detail
- String, number, multivalue picklist; no boolean
- Detail
- Measure columns only
- Detail
- Affects only datasets created afterwards
- Detail
- Reaches the dataset at the next full sync
Sources for this section (8)
- Sharing Inheritance Limitshelp.salesforce.com (opens in a new tab)
- Data Prep Recipehelp.salesforce.com (opens in a new tab)
- Determine If It Will Workhelp.salesforce.com (opens in a new tab)
- Edit a Datasethelp.salesforce.com (opens in a new tab)
- Predicate Expression Syntaxhelp.salesforce.com (opens in a new tab)
- Values in a Predicate Expressionhelp.salesforce.com (opens in a new tab)
- Comparison Operatorshelp.salesforce.com (opens in a new tab)
- Security Metadata Drifthelp.salesforce.com (opens in a new tab)
- Which comparison operators work only with measure columns?
- Why does Help favour groups for granting access to inherited records?
- When does an invalid predicate surface as an error?
- How do you match a column against a multi-select picklist on User?
- What is the longest predicate expression allowed?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the CRM Analytics and Einstein Discovery Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 26 lessons of the CRM Analytics and Einstein Discovery Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (22 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both