Can a user see a record they own if their profile has no Read on the object?

No — object permissions are required regardless of ownership.

What does “Grant Access Using Hierarchies” mean?

It lets users higher in the role hierarchy access records owned by those below them; it can be turned off only for custom objects.

What are View All and Modify All permissions?

Object-level permissions that bypass sharing for that object; “View All Data” and “Modify All Data” do it for every object — give them sparingly.

What is a muting permission set?

A permission set inside a permission set group that removes specific permissions from the group without changing the underlying sets.

What is Restriction Rule?

A rule that limits which records certain users can see even if sharing would grant access — the one feature that narrows visibility.

How do you secure login?

Enforce MFA, set login IP ranges and login hours on profiles, use SSO where possible, and monitor login history.

Salesforce Security Interview Questions: Sharing Model

Who can do what, on which records

Separate object and field permissions (profiles, permission sets, FLS) from record access (OWD and sharing). Start restrictive and open access deliberately.

PermissionsProfiles, permission sets and FLS.
RecordsOWD, role hierarchy and sharing rules.
TroubleshootingSharing button, login as and access summaries.

Security is the topic where admin interviews go deepest. The key is to separate what a user can do with an object or field from which records they can see — and to explain how each layer opens access further.

1. Explain the layers of Salesforce security.

Three questions Salesforce asks

Org accessCan the user log in? (users, login hours, IP ranges, MFA)
Object & field accessCan they read/edit this object and field? (profiles, permission sets, FLS)
Record accessWhich records? (OWD, role hierarchy, sharing rules, manual sharing)

A user needs all three: object permission without record access shows nothing, and record access without object permission grants nothing.

2. Profiles vs permission sets vs permission set groups?

Every user has exactly one profile — the baseline (login hours, page layout assignments, default record types). Permission sets add permissions on top, assigned to any number of users. Permission set groups bundle permission sets by job role. Best practice today: a minimal profile plus permission sets for everything else, because Salesforce is moving permissions off profiles.

Record access: start strict, then open up

Organization-Wide Defaults (OWD)The baseline for every record: Private, Public Read Only or Public Read/Write
Role hierarchyManagers see what their team owns
Sharing rulesOwner- or criteria-based access for groups, roles or territories
Manual sharing & teamsRecord-by-record access, account and opportunity teams
Apex managed sharingCode-driven sharing for complex rules

Sharing can only open up access beyond the OWD; it can never restrict below it. So set OWD to the most restrictive level any user needs, then grant access with the layers below.

4. What are Organization-Wide Defaults?

The default record access for each object for users who do not own the record: Private (only owner and above in the hierarchy), Public Read Only, Public Read/Write, and for some objects Controlled by Parent. External OWDs can be set separately for portal and community users.

Owner-based rules share records owned by certain users (a role or group) with others — “share all records owned by the Pune sales team with the Mumbai sales team”. Criteria-based rules share records that match field values — “share all Opportunities where Region = South with the South managers group”.

6. How do you restrict access to a single field?

Use field-level security (visible / read-only per profile or permission set). Removing a field from the page layout is not security — the field is still reachable through reports, list views and the API.

7. What are public groups and queues?

A public group is a set of users, roles or other groups used in sharing rules and manual sharing. A queue is a holding place that can own records (Cases, Leads, custom objects) until a member takes them — used with assignment rules.

8. How do you troubleshoot “why can this user see / not see this record?”

Use the Sharing button and “View Hierarchy”/“Why” on the record to see the reasons for access, check the user's profile and permission sets for object and field permissions, check the OWD, role position and sharing rules, and log in as the user to reproduce. Permission set and user access summaries also help.

Remember

Key points

Sharing only opens access
Never below the OWD.
Minimal profile + permission sets
The modern best practice.
Layouts are not security
Use field-level security.
Roles ≠ profiles
Roles affect records; profiles affect permissions.

Interview drill

Follow-up questions

What the interviewer asks after your first answer. Turn on practice mode, answer each one aloud, then reveal.

Practice mode (hide answers)

1 Can a user see a record they own if their profile has no Read on the object? Intermediate

No — object permissions are required regardless of ownership.
2 What does “Grant Access Using Hierarchies” mean? Intermediate

It lets users higher in the role hierarchy access records owned by those below them; it can be turned off only for custom objects.
3 What are View All and Modify All permissions? Intermediate

Object-level permissions that bypass sharing for that object; “View All Data” and “Modify All Data” do it for every object — give them sparingly.
4 What is a muting permission set? Advanced

A permission set inside a permission set group that removes specific permissions from the group without changing the underlying sets.
5 What is Restriction Rule? Advanced

A rule that limits which records certain users can see even if sharing would grant access — the one feature that narrows visibility.
6 How do you secure login? Basic

Enforce MFA, set login IP ranges and login hours on profiles, use SSO where possible, and monitor login history.