After defining objects, users, profiles, and permission sets in Skill Align, the next critical layer was not functionality — but visibility.

Because defining what users can do without defining what they can see leads to overexposure.

In Salesforce, record-level security operates in layered form:

• Organization-Wide Defaults (OWD) → Baseline visibility




• Role Hierarchy → Vertical access expansion




• Sharing Rules → Controlled horizontal exceptions

Profiles and Permission Sets define object-level permissions.


This phase I focused purely on record-level governance.

Important: Role Hierarchy and Sharing Rules can only expand access. They can never be more restrictive than OWD. OWD is always the foundation.

Organization-Wide Defaults (OWD)

What is OWD?

OWD defines the most restrictive level of access to records.

Common values:

• Private → Only the record owner can access




• Public Read Only → Everyone can view, only owner can edit




• Public Read/Write → Everyone can view and edit

Security begins here.

OWD Configuration in Skill Align

I intentionally started restrictive and expanded access only where required.

What This Means Practically

Because most objects are Private:

• Users can only see records they own.




• Access expands only through hierarchy or administrative override.




• Exposure is controlled by design — not by accident.

Role Hierarchy

What is Role Hierarchy?

Role Hierarchy provides vertical record visibility.

When:

• OWD = Private




• “Grant Access Using Hierarchies” is enabled

Users higher in the hierarchy automatically gain access to records owned by users below them.

Important distinction:

• Profiles → Control object permissions




• Roles → Control record visibility

In Skill Align:

Managers and Employees share the same profile.


They differ only by role — and that drives visibility.

Role Structure

   HR

    ↑

Project Manager

    ↑

Employee

Visibility follows structure.

How Visibility Works in Skill Align

Scenario 1: Employee Skill Record

An Employee updates their Skill record.

• The Employee can see and edit their record (owner).




• The Project Manager can see it because they sit above the Employee in the hierarchy.




• HR can see it due to administrative permissions.

This enables skill verification without exposing peer data.

Scenario 2: Project Assignment

Project Assignment records are owned by the Project Manager to reflect accountability.

• The Project Manager can view and manage the record (record owner).




• HR can see and modify it due to administrative permissions.



• 
  

  Employees cannot automatically see it because:

  
  
  
  
  
  • OWD is Private.
  
  
  • Their role sits below the Manager role.
  
  
  • Ownership represents responsibility.
  
  
  
  
  
  

Governance is embedded into ownership.

HR and Administrative Override

HR uses the System Administrator profile, which includes:

• View All Data




• Modify All Data

These permissions override OWD and hierarchy.

HR visibility is administrative — not inherited.

This separation ensures:

• Structural governance through roles




• Oversight through administrative control

Sharing Rules

What Are Sharing Rules?

Sharing Rules allow access to be extended horizontally — outside reporting lines.

Used for:

• Cross-team allocation reviews




• Governance committees




• Audit visibility

They expand access but never restrict it.

Did Skill Align Use Sharing Rules?

Not in this phase.

Because:

• Upward visibility is already handled via Role Hierarchy.




• Manager-owned records are intentionally restricted.




• Governance is preserved through restrictive OWD.

If employee visibility into Project Assignments becomes necessary, a controlled sharing rule can be introduced — without redesigning the architecture.

The foundation is scalable.

Final Visibility Flow

Employee

• Can see only records they own.




• Cannot see peer records.




• Cannot see Manager-owned Project Assignments.

Project Manager

• Can see Employee-owned records below them.




• Owns and governs Project Assignment records.




• Controls allocation lifecycle.

HR

• Full record visibility.




• Administrative oversight.




• Can verify skills and confirm allocations.