Salesforce Fundamentals18% of the exam
Object permissions, field-level security and restriction rules
How object permissions, View All and Modify All, field-level security, permission sets, permission set groups with muting, restriction rules and user licenses combine to extend or restrict what a user can reach.
Apply features and capabilities available to restrict and extend object, record, and field access.
~8 min read · 16 practice questions ·
What the exam expects
- Choose object permissions, including View All Records or Modify All Records over View All Data, and know which override sharing.
- Predict field access from field-level security plus the page layout, and secure formula fields that expose hidden data.
- Combine profiles, permission sets and permission set groups, and use a muting permission set to remove a permission from a group.
- Use a restriction rule to narrow records users can already see, and name what bypasses it.
- Choose a user license for a custom app and recognize licenses as the ceiling of what permissions can grant.
- Key terms: object permissions (base create, read, edit, delete access per object); field-level security (view or edit access per field); permission set group (bundle of permission sets for a persona); muting permission set (removes selected permissions inside one group); restriction rule (filter on records a user already has access to).
Key facts
Permissions that override sharing
- Detail
- View All Records and Modify All Records only
View All / Modify All and FLS
- Detail
- None of them overrides field-level security
View All Records and children
- Detail
- Reaches child custom objects, not standard detail objects
Layout plus FLS
- Detail
- Most restrictive setting applies
Formula and roll-up fields
- Detail
- Can show data from fields the user can't see
Muting
- Detail
- One muting permission set per group; affects only that group's grants
Restriction rule limits
- Detail
- 2 active per object (Enterprise, Developer), 5 (Performance, Unlimited)
Platform Starter vs Plus
- Detail
- 10 vs 110 custom objects per license; no leads, opportunities or campaigns
Restriction rule bypass
- Detail
- View All Records, View All Data, Modify All Records, Modify All Data
Sources for this section (6)
- Object Permissionshelp.salesforce.com (opens in a new tab)
- View All and Modify Allhelp.salesforce.com (opens in a new tab)
- Field Permissionshelp.salesforce.com (opens in a new tab)
- Muting Permission Setshelp.salesforce.com (opens in a new tab)
- Restriction Rule Considerationshelp.salesforce.com (opens in a new tab)
- Platform Starter and Plus featureshelp.salesforce.com (opens in a new tab)
- Why is View All Records usually better than View All Data for an auditor of one object?
- When does a user with View All Records on Account still miss some related cases?
- Which comparison operator can restriction rule criteria use?
- Why can't a permission set alone give a Platform-licensed user access to opportunities?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform App Builder pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 26 lessons of the Platform App Builder guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (16 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams