Our team needs to find a way to restrict access to account type = Goverment.
Due to the complexity of our current org in SFDC it's extremely difficult to do this at a profile / role level. (ex:not all users on the same profile wil be allowed to access Gov records) . We also didn't help ourselves by granting Account "view all / modify all" to almost all of our existing profiles. Account Sharing rules are also out of the question because we already allow almost all of our profiles to view all / modify all
One idea is to create a cloned account object and move those records to that object in order to restrict access. Not usre how feasible/practical is this since we have many intregations built into the account object already
Has anyone faced a similar problem? any other crazy ideas you might want to share?
Thank you in advance
Paula
2 个回答
Hi Paula
Cloning Accounts into another object is definitely not a good idea, particularly if you already have integrations notwithstanding that Accounts are central to the standard data model and you could either paint yourself into a corner and/or introduce a layer of unneccessary complexity into your org.
Thoughtful use of org wide sharing, sharing rules, role hierarchy, and to some extent profiles and permission sets will be the way you need to solve this..... failing that, Apex sharing could be an option if your business rules are very complex.I would start by:
- reviewing your role hierarchy. See if it is possible to split user roles based on who needs access to the Gov records
- Removing the "modify all" and "view all" permission on Account object for all user profiles and create a permission set to allow this, then assign the permission set to users who genuinely need to modify all records.
- Create Group(s) of users who need access to the Gov records
- Create criteria based sharing rules based on Account Type = "Gov" and share records with the Group(s) created in the previous step
- Set org wide default sharing for Account to Private
I'm assuming you will need to model various real world scenarios relevant to your business need, so I highly recommend you make these changes and test them in a sandbox (partial or full copy preferable) before implementing in your production environment.
Some resources you might find useful:
