Set the organization-wide default for an object and confirm the hierarchy behaviour. Do this before the object holds large volumes of production data, because later changes trigger a sharing recalculation.
- Open Sharing Settings
From Setup, type Sharing Settings in the Quick Find box and select Sharing Settings. The Organization-Wide Defaults table lists every object with its current internal and external access.
- Edit the defaults
Click Edit in the Organization-Wide Defaults area. For each object choose a Default Internal Access and a Default External Access. Remember external access must be equal to or more restrictive than internal access.
- Set hierarchy access for custom objects
For custom objects, decide whether to keep Grant Access Using Hierarchies selected. Leaving it on lets managers inherit subordinate records. Clearing it limits hierarchy-based access for that object.
- Save and wait for recalculation
Click Save. If you restricted access on a populated object, sharing recalculates in the background and you receive an email when it finishes. Verify access with a test user afterward.
Only the owner, users above them in the role hierarchy, and people granted access through sharing can see the record.
Everyone can view and report on records, but only owners and their managers can edit them.
Everyone can view, edit, and report on all records of the object.
Access to the record follows the user's access to its parent record, used with master-detail relationships.
- Restricting access on a large object runs an asynchronous recalculation that can take hours; widening access applies almost immediately.
- If Account is Private, Opportunity and Case must also be Private because they inherit account context.
- Default external access cannot exceed default internal access, and guest users are always Private with no override.
- You cannot switch a custom object from private to public if Apex code references its sharing entries.