Sharing Rules open up record access on top of the Org-Wide Default — they let you say "users in Role A also see records owned by Role B." They only ADD access; you can't restrict with sharing rules. The OWD must be Private (or Public Read Only) for sharing rules to be meaningful at all.
- Open Setup → Sharing Settings
Setup gear → Quick Find: Sharing Settings → Sharing Settings.
- Verify the Org-Wide Default for the object
Scroll to Organization-Wide Defaults. If the OWD for this object is Public Read/Write, sharing rules don't matter — everyone sees everything already.
- Scroll to the object's Sharing Rules section → New
Each object has its own Sharing Rules section. Click New.
- Name the rule
Label and Name. Conventions: "<from> shares with <to> at <level>" e.g. "Sales Reps share Accounts with Marketing".
- Pick Rule Type: Owner-based or Criteria-based
Owner-based: "records OWNED by group X are shared with group Y." Criteria-based: "records WHERE Field = X are shared with group Y." Criteria-based is more powerful but evaluates more often.
- Configure source and target
Source: who owns the records (Roles, Roles and Subordinates, Public Groups). Target: who gets access (same options). For criteria-based, Source is the filter.
- Pick Access Level
Read Only or Read/Write. Save.
Owner-Based, Criteria-Based, or Guest User Based. Criteria-based requires the Sharing By Criteria feature to be enabled per object.
Who owns / matches the records. Roles, Roles + Subordinates, Public Groups, Territories.
Who gets the access. Same options as Source.
Read Only or Read/Write. Cannot grant Full Access via sharing rule.
- Sharing rules only OPEN access — they cannot restrict it. To restrict, change the Org-Wide Default or use Apex Managed Sharing.
- Criteria-based sharing rules recalculate on every record save that matches or stops matching. On large data volumes this can be expensive — Salesforce caps you at 50 criteria-based rules per object.
- Sharing recalculation runs in the background. Big changes (mass Owner reassignment) can take hours to settle visibility — don't panic if a user can't see records immediately after a bulk update.