When to read this
No tab, short list, gray fields, forbidden on save, edit but cannot send for approval. You need vocabulary for admins and self-checks on sharing and state.
Four layers that stack
| Layer | Controls | What you notice |
|---|---|---|
| Security Profile + PermissionSet | Tabs, object CRUD, vault actions, fields | Entire application tab missing |
| Record sharing / matching | This row’s audience | Coworker sees row you do not |
| Lifecycle roles | Owner / Editor / Viewer | Edit but not send; send but not close |
| State atomic security | Actions and fields in this state | Actions vanish in approval |
All must pass for full access. Vault Owner bypass is for admins only.
PermissionSet (your view)
Admins attach PermissionSets to your profile. Map symptoms:
| Symptom | Often missing |
|---|---|
| No tab | Tab or object read |
| Read-only | No edit or field read-only |
| No Create | create / type create / prevent_create |
| No send for approval | Workflow vault action or lifecycle block |
| No audit button | view audit trail |
| No download | download or state block |
Profile names (QA, investigator, etc.) are customer-specific.
Lifecycle roles on the record
| Role (typical) | Often can |
|---|---|
| Owner | Send for approval, key fields, close, share |
| Editor | Edit content; may not delete parent |
| Viewer | Read-only; may still get assigned tasks |
Sources: create rules, workflow, Sharing, application automation. Task assignee ≠ Owner.
Sharing on the record
- Open Sharing (or team) on the record.
- Add users/groups with roles when you are allowed.
- Sharing does not replace object
readon PermissionSet.
Matching rules or parent inheritance may grant access without manual sharing.
Field and layout layer
Even with object edit you may hit field ACL, layout rules by state, or entry criteria on children.
Same record, coworker edits, you cannot: compare profile, sharing/role, then state.
Side effects and On Behalf Of
Application side-effect creates (e.g. Promote complaint) write as system; audit On Behalf Of is the user who clicked. That does not grant you manual create on the child object.
Self-check before admin ticket
- Same Security Profile as coworker?
- Sharing and state on this row?
- Should action run in My Tasks (In approval)?
- Child create/edit on PermissionSet?
Admin paths: Admin / Business Admin (users, permission sets, objects). No MDL steps here.
FAQ
| Symptom | Try |
|---|---|
| Coworker sees row | Profile + sharing + state |
| Tab but empty list | Saved view; or read without shared rows |
| Gray field | Field ACL, layout rule, atomic security |
| Edit but no send | Workflow action, not Owner, or state |
| Promote OK but no complaint access | Child read or sharing |
Next
- Lists and detail → Objects, lists, and detail
- Why no state-menu approve → Lifecycles and user actions