From what I have read and some online vids I've watched, I understood that record owners have full access to the records that they own. Full access meant that they could read, edit, delete and share that record.
However, to confirm this I created a record of an object and then assigned ownership of that record to a user that only had Read object level access. Then I logged in as the owner.
The owner could only see the record and not edit. When I added edit object permissions, they could then edit.
So, do object level permissions always filter out records and restrict what a user can do to that record, even if owned by the user?
Attribution to: Joe
Possible Suggestion/Solution #1
It's true, while sharing controls row level access, ultimately the object (table) and fields (columns) are controlled by the user's profile CRUD and FLS. In this case, the model is most restrictive - if you have edit on the row but only read on the object, you only have read; if you have edit on the object but only read on the row, you only have read on the record.
Would you ever expect someone with only read CRUD access to the record to have other access including edit or delete? If so, what?
Attribution to: Adam Torman
Possible Suggestion/Solution #2
From SF - Sharing Considerations:
While your sharing model controls visibility to records, user permissions and object-level permissions control what users can do to those records. Regardless of the sharing settings, users must have the appropriate object-level permissions. For example, if you share an account, those users can only see the account if they have the “Read” permission on accounts. Likewise, users who have the “Edit” permission on contacts may still not be able to edit contacts they do not own if they are working in a Private sharing model.
Administrators, and users with the “View All Data” or “Modify All Data” permissions, have access to view or edit all data.
Your observations are consistent with this documenation.
Attribution to: Peter Knolle
This content is remixed from stackoverflow or stackexchange. Please visit https://salesforce.stackexchange.com/questions/1578