Beginner 15 min read

Role Hierarchy Explained

By the end of this lesson, you'll be able to:

  • Explain how the role hierarchy grants implicit record access
  • Identify when the role hierarchy does NOT grant access to a custom object

Prerequisites: Organization-Wide Defaults & Sharing Settings

How the hierarchy grants access

Roles are arranged in a tree, and access flows upward: a user automatically inherits access to every record owned by (or shared with) the users in roles below them. This is separate from, and stacks on top of, the Organization-Wide Default baseline.

Unlike sharing rules, nothing needs to be explicitly configured per object — the hierarchy applies automatically to every standard object, and to custom objects unless it's been switched off.

Opting out for custom objects

Custom objects have a Grant Access Using Hierarchies checkbox in their sharing settings. Unchecking it stops the role hierarchy from automatically granting access for that object — useful for sensitive custom objects (like a Payroll__c object) where even a manager shouldn't automatically see every record below them.

Standard objects don't offer this opt-out — hierarchy access always applies to them.

Finding the top of the role hierarchy

List<UserRole> topLevelRoles = [
    SELECT Id, Name, ParentRoleId
    FROM UserRole
    WHERE ParentRoleId = null
];

Roles with a null ParentRoleId sit at the very top of the hierarchy — every other role eventually rolls up to one of these.

Exercise

Write a SOQL query that returns the Name of every UserRole that is a direct child of a role named 'VP Sales'.

Show hint

Query UserRole where ParentRole.Name = 'VP Sales'.

SOQL

Role Hierarchy Explained — Quick Check

1. In a standard role hierarchy, who automatically gains access to a record owned by a user in role 'Sales Rep'?

2. Grant Access Using Hierarchies can be disabled for standard objects like Account.

3. What field on UserRole identifies its parent in the hierarchy?

Log in to submit the quiz and save your score.

My Notes

Log in to keep private notes on this lesson.

Questions about this lesson

No questions yet — be the first to ask.

Log in to ask a question about this lesson.

Summary

The role hierarchy automatically grants users read (and usually edit) access to every record owned by, or shared with, the users below them — a manager sees what their reports see, without any extra configuration.

Log in to track progress
← Organization-Wide Defaults & Sharing Settings Profiles vs. Permission Sets →