Designing a least-privilege external security model
How to design external access that grants only what each persona needs: one custom profile plus permission sets and groups, access-summary reviews, the oversharing paths through nested public groups and portal subordinates, Apex that guests can call, and targeted sharing when account role optimization is on.
Given a scenario, determine a security model based on an Experience use case.
~8 min read · 7 practice questions ·
What the exam expects
- Determine a security model for an Experience Cloud use case: custom external profiles, permission sets and permission set groups, site membership and a Private external default.
- Recommend how to review external access periodically and trace which feature grants a permission.
- Spot the oversharing paths: nested public groups that contain external users, sharing rules that use Roles, Internal and Portal Subordinates, and records visible up the external role hierarchy.
- Secure Apex that guests or external users reach from Lightning components on Aura and LWR sites.
- Choose targeted sharing when account role optimization (ARO) is on.
Key terms: least privilege (only the access and abilities required to complete the work); access summary (a user's or group's assigned permissions, groups and queues, with Access Granted By); nested public group (a group that contains another group); targeted sharing (sharing with a specific user or a group containing them, not with a role); shared person role (the one role ARO gives single-user accounts).
Key facts
- Detail
- Keep Private where possible
- Detail
- Custom profiles, not the standard license profiles
- Detail
- Permission sets and permission set groups, not more profiles
- Detail
- Representative user's access summary, then Access Granted By
- Detail
- Can be nested; outer-group rules reach inner external members
- Detail
- Older orgs: Roles, Internal, and Portal Subordinates becomes Roles and Internal Subordinates
- Detail
- with sharing, plus guest profile class access
- Detail
- Never target the shared person role
- Detail
- Roll up to the account owner, typically the channel manager
Sources for this section (4)
- Why do persona differences belong in permission set groups rather than in extra cloned profiles?
- When can a sharing rule aimed at a seemingly internal public group still reach partners?
- What does an @AuraEnabled class that guests can run need on the class and on the guest profile?
- Why shouldn't a sharing rule target the shared person role under ARO?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Experience Cloud Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 37 lessons of the Experience Cloud Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams