Data Modeling/Database Design25% of the exam
Record access design: OWDs, hierarchies and territories
How to open access from restrictive organization-wide defaults with role hierarchies, sharing rules, teams, territories and Apex managed sharing, what implicit sharing does and doesn't grant, and how restriction rules and View All fit a scalable model.
Given a scenario, recommend approaches and techniques to design a scalable data model that obeys the current security and sharing model.
~7 min read · 14 practice questions ·
What the exam expects
- Set organization-wide defaults to the most restrictive level and open access with the lightest component that fits.
- Predict what parent and child implicit sharing grant on Account, and why account hierarchies and custom objects get none.
- Design a role hierarchy around levels of data access, and decide when Sales Territories (Enterprise Territory Management) beats roles or teams.
- Choose among owner-based rules, criteria-based rules, nested public groups, teams, Apex managed sharing, restriction rules and object-level View All.
Key terms: organization-wide default (OWD) (baseline record access per object); implicit sharing (built-in Account parent/child access); Controlled by Parent (child access follows the master); restriction rule (filters records a user can already reach); Apex managed sharing (share records written by code, kept across owner changes).
Key facts
Role hierarchy depth
- Detail
- Best practice: no more than 10 levels of branches
Public group nesting
- Detail
- No more than five levels
Sharing rules per object
- Detail
- 300 total; 50 criteria-based and guest user
Grant Access Using Hierarchies
- Detail
- Configurable for custom objects only
Implicit sharing
- Detail
- Account children only; not custom objects; can't be turned off
Parent implicit sharing
- Detail
- Read-only; not granted by View All on the child
Teams
- Detail
- One team per Account, Opportunity or Case record
Apex managed sharing
- Detail
- Kept across owner changes; sharing reasons on custom objects only
Restriction rules per object
- Detail
- 2 active (Enterprise, Developer); 5 (Performance, Unlimited)
- Why is an object-level View All permission preferred over View All Data for an audit team that reads one object?
- When is territory management a better fit than account teams?
- Why should public groups not be nested more than five levels?
- What happens to Apex managed shares when the record owner changes?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Data Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Data Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (14 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams