Newbie to user permissions and to approval processes. Up to now, everyone on our small team has been an Admin. I need help with two objectives.
In approval processes, I need to prevent most users from being able to unlock a record that has been locked during selected steps the approval process. I believe that default behaviour is that any Admin is able to unlock records that are in a locked status. Not sure what the easiest way to accomplish this is and the granularity within permission schemes looks mind-boggling and terrifying! Can I simply clone the Administrator profile and remove the ability to unlock records that have been locked by the approval process? If so, I need help finding that permission in order to disable it.
We also use a custom object to record commissions details. I need to be able to control visibility of those records. On each record, we have a user picklist where we designate who the commission goes to. Is it possible to make each record visible to and usable only by a specified user group plus the individual user selected in that user picklist? We only want commission details to be visible to the commission recipient plus a selected group of managers.
Any help appreciated.
Tom Bassett (Vera Solutions) 
Forum Ambassador
To recap if your custom object has a master-detail relationship users will gain access if they have access to the Parent Record.
For example, if they have access to the Account then they would have access to the Commission records too.
You could restrict this using a Restriction Rule OR by changing the relationship to lookup - however you'd lose any roll up summaries as a result so this may not be a option
