Organization Wide Sharing Defaults

Organization-Wide Sharing Defaults:

• Administrators can use organization-wide sharing settings to define the default sharing settings for an organization.
• Organization-wide sharing settings specify the default level of access to records and can be set separately for accounts (including assets and contracts), activities, contacts, campaigns, cases, leads, opportunities, calendars, price books, and custom objects. 
• For most objects, organization-wide sharing settings can be set to Private, Public Read Only, or Public Read/Write.
• Setting an object to Private makes those records visible to record owners and those above them in the role hierarchy.
• Custom objects can have separate organization-wide defaults for internal and external users, therefore simplifying your sharing rules configuration and improving recalculation performance.

External users include:

• Authenticated Website users
• Service Cloud Portal users
• Customer Portal users
• Partner Portal users
• Guest users
• With separate organization-wide defaults, you can achieve similar behavior by setting Default Internal Access to Public Read Only or Public Read/Write and Default External Access to Private. 
• Enable separate organization-wide defaults by clicking Your Name | Setup | Security Controls | Sharing Settings and clicking the Enable External Sharing Model button.

Creating Organization-Wide Sharing Defaults:

1. Click Your Name | Setup | Security Controls | Sharing Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. For each object, select the default access you want to use. If you have a portal enabled with separate organization-wide defaults, see Separate Organization-Wide Defaults.
4. To disable automatic access using your hierarchies, deselect Grant Access Using Hierarchies for any custom object that does not have a default access of Controlled by Parent.

Controlled By Parent:

A user can perform an action (such as view, edit, or delete) on a contact based on whether he or she can perform that same action on the record associated with it.

For example, if a contact is associated with the Acme account, then a user can only edit that contact if he or she can also edit the Acme account.

Private:

Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records. For example, if Tom is the owner of an account, and he is assigned to the role of Western Sales, reporting to Carol (who is in the role of VP of Western Region Sales), then Carol can also view, edit, and report on Tom’s accounts.

Public Read/Write:

All users can view, edit, and report on all records.

For example, if Tom is the owner of Trident Inc., all other users can view, edit, and report on the Trident account. However, only Tom can alter the sharing settings or delete the Trident account.

Public  Read Only:

All users can view and report on records but not edit them. Only the owner, and users above that role in the hierarchy, can edit those records.

For example, Sara is the owner of ABC Corp. Sara is also in the role Western Sales, reporting to Carol, who is in the role of VP of Western Region Sales. Sara and Carol have full read/write access to ABC Corp. Tom (another Western Sales Rep) can also view and report on ABC Corp, but cannot edit it.

Public Read/Write/Transfer:

All users can view, edit, transfer, and report on all records. Only available for cases or leads.

For example, if Alice is the owner of ACME case number 100, all other users can view, edit, transfer ownership, and report on that case. But only Alice can delete or change the sharing on case 100.

Public Full Access:

All users can view, edit, transfer, delete, and report on all records. Only available for campaigns.

For example, if Ben is the owner of a campaign, all other users can view, edit, transfer, or delete that campaign.