Sharing Rules & Manual Sharing
By the end of this lesson, you'll be able to:
- Explain when to use a sharing rule versus manual sharing
- Distinguish criteria-based and owner-based sharing rules
Prerequisites: Field-Level Security
Sharing rules: automatic and rule-based
Sharing rules come in two flavors: owner-based (share every record owned by a given role or group with another role or group) and criteria-based (share records matching a field condition, e.g. Region__c = 'EMEA'). Both always widen access above the Organization-Wide Default — they can never be used to restrict it.
Manual sharing: one record at a time
When Organization-Wide Default is less than Public, a record's owner (or anyone with full access) can use the Share button on a record's detail page to grant Read or Read/Write access to a specific user or group, one record at a time.
This is fine for a genuine one-off exception, but it doesn't scale — sharing hundreds of records this way is exactly what sharing rules, or programmatic Apex managed sharing, are for.
Sharing a record programmatically
AccountShare share = new AccountShare();
share.AccountId = accountId;
share.UserOrGroupId = userId;
share.AccountAccessLevel = 'Edit';
share.RowCause = Schema.AccountShare.RowCause.Manual;
insert share;Every shareable object has a companion '__Share' object — inserting a row there is exactly what clicking 'Share' in the UI does under the hood, and it's how Apex grants sharing programmatically (Apex Managed Sharing).
Exercise
Write Apex that grants Read access to a Contact record for a specific Group, by inserting a ContactShare record.
Show hint
ContactShare uses ContactId, UserOrGroupId, ContactAccessLevel, and RowCause = Schema.ContactShare.RowCause.Manual.
Sharing Rules & Manual Sharing — Quick Check
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
Sharing rules automatically extend access to groups of records based on ownership or criteria; manual sharing extends access to one specific record at a time, by a user who already has full access to it.