Access computed per record rather than read off a screen: pick a person and a record and six layers evaluate live, highlighting the one that actually decided.
CRM access model
Access isn't a setting — it's computed per record. The most permissive layer wins.
Read / write
who is asking
which record
Northwind expansionowner Marcus · PrivatestageNegotiationamount$48,000
Profile(cap)Caps this user at read / write on Opportunity.write
Record ownerOwns the record, so always has full access to it.write
Org-wide defaultPrivate — the baseline grants nothing to anyone but the owner.—
Role hierarchyNot above the owner — hierarchy only ever rolls access upward.—
Sharing ruleNo rule matches this user and record.—
Team / manual shareNot on this record's team, and no manual share.—
Read / writemost permissive layer wins → Record owner
Layers union upward:profile caps+owner+org default+hierarchy+sharing+teamtouring
