Record-Level Access - Under the Hood - Data Access in Salesforce

Oct 25, 2026

Record-Level Access: Under the Hood explains how Salesforce security translates organizational security requirements into an effective data access model. The paper contrasts the user’s perspective of “having access” with the architect’s need to grant only the appropriate access levels. It details how data access splits into object-level (including field-level security and object permissions) and record-level access (Sharing) using organization defaults, role and territory hierarchies, sharing rules, teams, and manual or programmatic sharing, then outlines how Salesforce recalculates and grants access at the database level.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages22

Reading Time55 min

AccessFree to download

Preface

Data Access in Salesforce

Record Access Calculation

Access Grants

Sample Scenarios

Putting It All Together

Summary

Record-Level Access: Under the Hood Salesforce, Winter ’27 Last updated: September 11, 2026 © Copyright 2000–2026 Salesforce, Inc. All rights reserved. Salesforce is a registered trademark of Salesforce, Inc., as are other names and marks. Other marks appearing herein may be trademarks oftheir respective owners. CONTENTS RECORD-LEVEL ACCESS: UNDER THE HOOD .......................... 1 Preface ............................................................. 1 Data Access in Salesforce ................................................ 1 Record Access Calculation ............................................... 3 Access Grants ........................................................ 3 Database Architecture .................................................. 4 Sharing Rows ........................................................ 5 Group Maintenance Tables ............................................... 6 Sample Scenarios ..................................................... 9 Putting It All Together ................................................... 14 Summary .......................................................... 17 RECORD-LEVEL ACCESS: UNDER THE HOOD Preface If you’re a Salesforce architect, you already know your overarching goal for data security: Understand your company’s enterprise security model, then build a data access model that reflects it in your Salesforce organization. You have a rich set of Salesforce tools at your disposal for managing that data access, but you don’t manage it at just one level. Instead, you must carefully consider when and how to control access at the object, record, and field levels. In this paper, you can find a brief overview of these different levels of data access, and under the hood, table-level views of record-level access. After reading Record-Level Access: Under the Hood, you should feel better prepared to give the right users the right access to the right records at the right time—and do so in the fastest time possible. Audience This paper is intended for expert architects working on Salesforce implementations that have complex record access requirements or require large-scale realignments of sales organizations. Assumptions This paper assumes that you are an expert in Salesforce administration and security, and in SQL and relational database concepts. Data Access in Salesforce To meet your company’s security needs, it’s important to understand what data access means to your users and to you. Data Access: User’s Perspective If you put yourself in your users’ shoes, you won’t necessarily know or care how you’re getting access to records, but you might want to understand what having access means within the context of your organization. The following graph can help users visualize the different kinds of access that can be configured in Salesforce. Record-Level Access: Under the Hood Data Access in Salesforce For example, if a user has access to an account field, then they have access to both the account field and the account object itself. However, a specific account record, such as “Account A”, might not be accessible to that user due to additional access control applied via sharing rules or other tools. Data Access: Architect’s Perspective As an architect, you must both understand your user’s perspective and know how to grant users only the appropriate level of access to the data that they should be able to access. From an architect’s perspective, data access in Salesforce falls into two main categories: object-level access, which includes field-level access, and record-level access. Object-level access determines whether a user has access to a particular object, which fields they can see on that object, and which actions they can perform. You configure object level access on user profiles. Restricting access The “Read,” “Create,” “Edit,” and “Delete” object permissions determine which actions a user can perform on any of

FAQs

How does Salesforce data access differ between user and architect perspectives?

From a user perspective, access is about what it means to work with records in the organization. From an architect perspective, access must be granted at the right level by understanding and implementing object-level (field-level) and record-level access correctly.

What are the main components of record-level access (Sharing) in Salesforce?

Record-level access uses tools such as organization-wide defaults, role hierarchy, territory hierarchy, sharing rules, teams, manual sharing, and programmatic sharing.

How does Salesforce determine which records a user can access?

When a user opens a record, runs a report, accesses a list view, or searches via UI or API, Salesforce checks record access configuration to decide which records the user can access, then recalculates access when sharing configurations change.

Oct 25, 2026

Uploaded by Alexandar