Beginner 15 min read

Organization-Wide Defaults & Sharing Settings

By the end of this lesson, you'll be able to:

  • Explain what Organization-Wide Defaults (OWD) control
  • Distinguish Private, Public Read Only, and Public Read/Write settings
  • Recognize that OWD sets the baseline, and sharing tools only ever widen it

Prerequisites: Understanding the Salesforce Security Model

What OWD controls

Organization-Wide Defaults set the baseline record-level access to an object's records for users who don't own them: Private (only the owner and roles above them can see it), Public Read Only, or Public Read/Write. Some objects also support Controlled by Parent, inheriting access from a related record.

This baseline applies before any other sharing tool comes into play — it's the floor everything else builds on.

OWD is a floor, not a ceiling

If OWD for an object is Private, no one but the owner (and roles above them in the hierarchy) sees a given record — until a sharing rule, role hierarchy, or manual share explicitly grants more access. Every sharing mechanism in Salesforce adds access on top of OWD; none of them can restrict a user below what OWD already allows.

If you need tighter access for a subset of users, the fix is always to set OWD stricter and widen access for everyone else with sharing — never the other way around.

Checking a user's actual record access

UserRecordAccess access = [
    SELECT HasReadAccess, HasEditAccess
    FROM UserRecordAccess
    WHERE UserId = :UserInfo.getUserId()
    AND RecordId = :someAccountId
];
System.debug(access.HasEditAccess);

UserRecordAccess lets you check, at runtime, exactly what access — read, edit, or transfer — the current user actually has to a specific record, taking every sharing layer into account.

Exercise

Write a SOQL query against UserRecordAccess that checks whether the running user has read access to a specific Contact record (Id stored in a variable named contactId).

Show hint

Filter WHERE RecordId = :contactId AND UserId = :UserInfo.getUserId(), then check HasReadAccess on the result.

APEX

Organization-Wide Defaults & Sharing Settings — Quick Check

1. What does an Organization-Wide Default of 'Private' mean for an object?

2. Sharing rules can be used to restrict access below what Organization-Wide Defaults allow.

3. Which OWD setting allows all users to view records they don't own, but not edit them?

Log in to submit the quiz and save your score.

My Notes

Log in to keep private notes on this lesson.

Questions about this lesson

No questions yet — be the first to ask.

Log in to ask a question about this lesson.

Summary

Organization-Wide Defaults set the most restrictive baseline record-level access for an object. Every other sharing mechanism — role hierarchy, sharing rules, manual sharing — can only grant additional access on top of that baseline, never restrict it further.

Log in to track progress
← Understanding the Salesforce Security Model Role Hierarchy Explained →