Hi Everyone,
I'm working on a Salesforce security requirement and would appreciate your guidance on the best approach.
Scenario:
- North Finance users should be able to access only North region invoices.
- South Finance users should be able to access only South region invoices.
- Finance users should not be able to view or edit invoices belonging to other regions.
I'm trying to determine the most scalable and maintainable solution.
My questions are:
- Which Salesforce security features would you recommend for this scenario (OWD, Roles, Sharing Rules, Permission Sets, Criteria-Based Sharing, Apex Sharing, etc.)?
- Is it possible to achieve this requirement using only declarative features, or would Apex Sharing be required?
Hey Deepak,
I would recommend keeping Invoice OWD as Private, then creating roles for each region (with sub-roles if needed) and using sharing rules based on ownership if the users with in those regional nodes own the records, or criteria based sharing rules if users outside of these regions own the invoices. This is declarative and a very straightforward use case for sharing rules.
Be sure you only grant read unless by "access" you mean they can edit the records as well within their own region. Also, if you prefer not to create the roles, you can use public groups, but it may be more difficult to manage long term. Let me know if you have any questions. Good luck!
