Understanding how Salesforce protects data
August 07, 2015
To understand the current CRM landscape, we have to understand the capability and trends for the use and development of Salesforce. It now forms the expectations for almost all sales people.
On my path to becoming a certified administrator for Salesforce, I will occasionally share exceptionally good explanations and tips. Salesforce produces phenomenal free training materials, such as Trailhead. So when I share something here, it's because it cuts through the clutter and takes our understanding of Salesforce to a new level.
Even if Salesforce is not your bag, we all have much to learn from it, and we need to understand why it's become such as force for good.
Salesforce Weekly: Driving Data Access, 2014-Aug-26 by Chris Edwards
...profiles and permission sets control what you can do in Salesforce, and org-wide defaults and roles control what you can do it to (or, put another way, what you can see)...
Just today I answered a question on the Answers forum from somebody wanting to know which ‘wins’ or which one overrides the other. The simple answer is that they control different things and therefore neither ‘wins’ – it is the intersection of what they both allow which dictates what each user can do. Just because I have a driving license doesn’t mean I can drive your car, and just because I get hold of someone’s car keys doesn’t mean I’m legally allowed to be on the road.
However, there is one thing we should point out. Some profiles (typically those reserved for system administrators) have a couple of permissions – View All Data and Modify All Data – which do override the role hierarchy and org-wide default sharing. Think of these super-permissions as a kind of super-licence: just by flashing my pass, I can take your car and do what I please with it.