Internal and external OWDs and restriction rules
How to pick the internal, external and guest organization-wide default for each object, which platform constraints lock or force a default, when a default change takes effect, and when a restriction rule or a scoping rule fits better than a tighter default.
Given a set of conditions, recommend the appropriate organization-wide defaults to restrict access to records.
~8 min read · 13 practice questions ·
What the exam expects
- Recommend the internal default per object from who must view, edit, transfer or delete records they don't own.
- Recommend a separate external default for authenticated external users, and explain why guest users stay Private.
- Recognise the constraints that force or lock a default.
- Predict when a default change takes effect.
- Choose between a tighter default, a restriction rule and a scoping rule.
Key terms: OWD (baseline access to records a user doesn't own); external OWD (a separate baseline for authenticated external users); Controlled by Parent (access follows the parent record); sharing recalculation (the job that applies access changes); restriction rule (hides records a user could otherwise reach); scoping rule (default focus that never restricts access).
Key facts
- Detail
- Public Read/Write/Transfer: cases and leads only
- Detail
- Opportunity and Case Private; Contact Private or Controlled by Parent
- Detail
- Block a custom object's change from private to public
- Detail
- Former detail reverts to Public Read/Write, hierarchies on
- Detail
- External never more permissive than internal
- Detail
- Private for all objects; can't be changed
- Detail
- Increase: immediate; decrease: after recalculation
- Detail
- 2 active per object (Enterprise, Developer); 5 (Performance, Unlimited)
Sources for this section (5)
- Organization-Wide Default Access Settingshelp.salesforce.com (opens in a new tab)
- Set Your Internal Organization-Wide Sharing Defaultshelp.salesforce.com (opens in a new tab)
- Guidelines for Success with Roleshelp.salesforce.com (opens in a new tab)
- External Organization-Wide Defaults Overviewhelp.salesforce.com (opens in a new tab)
- Restriction Ruleshelp.salesforce.com (opens in a new tab)
- If Account is Private, which Contact defaults are allowed?
- Why would external users in an org created after Spring '20 start with no access to Campaign records when the internal default is Public Full Access?
- Why might a user with View All Records still see records a restriction rule should hide?
- When the User default is Private, whose user records can a user read?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Sharing and Visibility Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Sharing and Visibility Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams