Study first
Review the ideas behind the questions
Review the access layers that answer common CRM permission requests. Focus on whether the user needs the object, a subset of records, a sensitive field, or a specific activity action.
Start with what the user needs to do
A permission request should be translated into the smallest access layer that fits the job.
- Object permissions answer whether a user can create, read, edit, or delete records of a certain object type.
- Record access answers which records inside an allowed object the user can see or change.
- Permission sets and permission set groups can grant object, field, and user permissions for job tasks and personas.
In Practice
Name the access layer
Before changing permissions, decide whether the request is about the object type, a group of records, a sensitive field, or an activity action.
Use groups for repeatable roles
When several users need the same job-based access, group the permissions by role instead of making one-off access choices.
Common mistakes
Granting broad object access when the user only needs a smaller record set.
Keep object access as the baseline, then use record access controls to limit which records the user can reach.
Q&A
What is the first access question to ask?
Ask what the user needs to do: create, view, edit, delete, merge, report, or work only on certain records.
Are object access and record access the same thing?
No. Object access covers the type of record, while record access narrows which records inside that type the user can reach.
Protect records and sensitive fields
Some requests are about who can reach a record. Others are about hiding or locking only one field on a record.
- Record access can limit users to records they own, records their team owns, or other scoped groups, depending on the CRM setup.
- A high-privilege admin role may override record restrictions and should be removed before testing restricted access.
- Field or property access can protect a sensitive field without hiding the whole CRM object.
In Practice
Do not hide the whole object for one field
If the user needs the record but not one sensitive field, field access is usually the cleaner access layer to inspect.
Check admin override before testing
A test user with a broad admin role may still see restricted records, so use a realistic user account when verifying access.
Common mistakes
Using page layout changes as the only control for sensitive field data.
Use field-level or property access settings when the goal is to control whether users can view or edit the field value.
Q&A
When should a sensitive field be restricted instead of the full object?
Restrict the field when users still need the record but should not see or edit that specific value.
Review access before changing it
Permission changes should be checked from the user's view and from the record or object being protected.
- Access summaries can show what permissions a user has and how that access is granted.
- A record access view can show users with access to a record and their access level.
- Some create permissions cover manual record creation and importing, but do not control records created through other tools such as forms or workflows.
In Practice
Trace access to its source
When a user has more access than expected, check whether it comes from a profile, permission set, permission group, owner rule, team scope, or admin role.
Separate manual creation from system-created records
A permission that blocks a user's manual creation may not stop records that arrive from forms, workflows, or integrations.
Common mistakes
Changing permissions without checking how the user got access in the first place.
Review the user's access summary or record access view before changing broad permissions.
Q&A
Why check access summaries before changing permissions?
They help show what access the user has and where it came from, so you can fix the right source instead of guessing.