Complex sharing: multi-region OWD, role hierarchy, dozens of sharing rules, Apex managed sharing, Communities.
Strategy:
1. Map the sharing model.
- Document expected behavior per persona.
- "Sales Rep in EMEA region sees own + team's opportunities."
- "Service Manager sees all cases regardless of region."
- "Partner Community user sees only their account's records."
2. Define test users per persona.
- Create users with each profile / permission set / role / region combination.
- Maintain in test data setup.
3. Test matrix.
For each user × each record type × expected access (Read/Edit/None):
| User Persona | Record Type | Expected Access | |---|---|---| | EMEA Sales Rep | Their own Opp | Read/Edit | | EMEA Sales Rep | Other EMEA Opp | Read | | EMEA Sales Rep | NA Opp | None | | Service Manager | Any Case | Read | | Partner Community | Account's Cases | Read |
4. Automated tests.
`apex @isTest static void testEMEASalesRepCanSeeOwnOpps() { User rep = setupEMEASalesRep();
System.runAs(rep) { Opportunity own = createOppOwnedBy(rep); Opportunity teamOpp = createOppOwnedBy(setupEMEASalesRep()); Opportunity naOpp = createOppOwnedBy(setupNASalesRep());
List<Opportunity> visible = [SELECT Id FROM Opportunity]; System.assert(visible.contains(own.Id)); System.assert(visible.contains(teamOpp.Id)); System.assert(!visible.contains(naOpp.Id)); } } `
Repeat per persona × scenario.
5. UI tests.
- Login as each persona.
- Navigate to records.
- Verify what's visible / accessible.
- Provar / Selenium / Cypress.
6. Sharing rule testing.
- Create sharing rule.
- Test data hits / misses rule criteria.
- Confirm grant works.
7. Apex Managed Sharing testing.
- Create record.
- Apex managed sharing should run.
- Test target user gets access.
- Negative: test target user without share doesn't.
8. Community / Experience Cloud testing.
- Login as community user via "Login As".
- Verify external user sees only their data.
- Test Sharing Sets.
9. Performance testing.
- Bulk create records.
- Time sharing recalculation.
- Identify if model scales.
Common pitfalls:
- Insufficient test users — don't cover all personas.
- System Admin testing — bypasses sharing.
- Manual-only testing — sharing changes go untested in regression.
Senior QA insight: sharing model is one of the most-bug-prone areas. Comprehensive testing is essential.
The senior framing: sharing tests are security tests. Unauthorized access = security incident. Treat with appropriate rigor.