Sometimes a user needs access to exactly one record that their security role and business unit wouldn’t otherwise grant — without changing their role for everyone, or restructuring teams. That’s what record sharing is for.
How sharing works
Any user with the Share privilege on a table can grant another specific user or team a defined subset of access (Read, Write, Delete, Append, Assign, Share) to one individual record, independent of their normal security role. It’s stored per-record, not as a role change.
When sharing is the right tool
- A genuine one-off exception — a specific Opportunity needs input from someone outside the usual sales team.
- Cross-business-unit collaboration on a single record, without restructuring BUs or roles.
When it’s the wrong tool
If the same kind of exception keeps happening across many records or many users, that’s a sign the underlying security model (roles, teams, hierarchy security) is missing something structural — sharing doesn’t scale as a workaround for a systemic gap. Manually shared records are also easy to lose track of over time, since there’s no simple, centralized view of “everything shared with this user” the way there is for role assignments.