Can a user have more than 1 restriction rule applied to them?

Question

I have a situation where a client has 4 brands on the same platform. They share Account and Contact records across brands but don't want other brands to be able to see their task and event records. The restriction rules work great for users that support only 1 brand, but some users support 2 brands. These users are only able to see tasks and events for one of the two brands they support.

I have 4 brand checkboxes on the User record that identify which brands the user supports. Then I have 4 record types on task that correspond to the brand. I want users with any combination of brand checkboxes on their User record to see the corresponding tasks.

Is this the expected functionality or do I need to create a Case?

Larry Tung · Accepted Answer

Hi Clayton,

Ultimately it depends on how easy it is to categorize your users in relation to the records.

For example, one rule is

[Object].brand__c = $User.brand__c

This is a single rule, with no need to hard-coded values (in the rule).

However, you will then need to manage the field values on the object and on the user.

I'm guessing you're a UE customer (5 active rules). Ensure your users don't have more than 1 rule applied to them per object. If you have special cases, hopefully those can also be solved either with flow or apex (to set proper values on the record) since we don't support formulas.

@Dan Sheehan (He/Him) - https://help.salesforce.com/s/articleView?id=sf.security_restriction_rule_examples.htm&type=5 (I'm wondering whether our examples need any tweaking as there has been a few posts in this group regarding "how do I ..." where it is not always intuitive that we now are trying to have comparison of values on the current user and the data in the record...

Clayton - can you share some insights on whether you read any of our documentation or the welcome page that shows up in the admin UI? Or any other resources you looked at? I'm just often curious how folks learn about and attempt to solve problems with the various tools salesforce provides. Something I'd like to eventually get to is how to "simplify" the various record access tools and ways we can better help folks quickly understand and secure their record access.

Clayton Goss · Answer

Hi  @Larry Tung https://trailblazers.salesforce.com/profileView?u=0053A00000DLP9jQAH ,   That was the piece I was missing, thank you so much!  For anyone who's in a similar situation, here's what I did: Created a Flow on the User to check one of three boxes depending on which brand(s) the user supports (Single Brand Only, Brand A & B, Brand C & D).  All users will fit into one of these three categories. Created Flows on Task and Event to populate the brand (string) on the record, and checks one of two boxes depending on the brand.  I.e. if it's Brand A, it checks the Brand A & B checkbox, if it's Brand C it checks the Brand C & D checkbox. Created 3 restriction rules on Task and Event.   First one is for Single Brand Only users (based on checkbox) and shares the  records where [Object].brand__c = $User.brand__c.  Second one is for Brand A & B users and shares the records where [Object].Brand_A_B__c = TRUE Third one is for Brand C & D users and shares the records where [Object].Brand_C_D__c = TRUE   This is the first time I've heard about restriction rules so I was starting from scratch.  I started with the help pages, then cruised through this group and watched the videos you provided.  I'll admit I probably didn't spend as much time going through the material as I should have :)   I think all the issues I ran into were covered in the material, I just had to take some time to understand how it worked.  It's a little unintuitive and it's different from how the rest of salesforce permissions work.  Which is good, but takes some adjusting in how I think about it.  Maybe an animated intro video would help to explain things.   All in all, it's a great feature and saved us from turning to custom code.   Thank you!

Can a user have more than 1 restriction rule applied to them?

Record Access (Sharing)

More Help