Salesforce: Child Implicit Sharing

In the previous blog, we discussed Parent Implicit Sharing, let's discuss Child Implicit Sharing now.

Child Implicit Sharing is the ability of the Account owner, even if the user does not have access to the child record as defined in that child record.

Child Implicit Sharing also applies to the Account team, if the user is added as an account team member and given access to relevant child access (contacts, opportunities, and cases).

Querying the child Share object, such as OpportunityShare, you will see the RowCause as ImplicitChild.

Example: SELECT Id, UserOrGroupId, OpportunityAccessLevel, RowCause FROM OpportunityShare WHERE UserOrGroupId = '00580000001ren7AAA' AND OpportunityId = '0062H00001ESrWYQA1'

For the account owner, the account owner's role determines the level of access to child records (read-only or read/write). The same scenario is also applicable to users above the Account owner in the role hierarchy.

The above screenshot is taken from org. with all contact, opportunity, and case sharing settings "Private". If Contact sharing is "Controlled by Parent", you will not see Contact access here - the account owner will have full access to the Contact, even if the Contact is owned by another user.

Object (contact, opportunity, and case) with sharing "Public Read/Write" will also not be shown here, because all users have permission to read and edit the records.

Since the Winter '24 release, salesforce introduced Faster Account Sharing Recalculation, where the sharing access is not stored in CaseShare, ContactShare, or OpportunityShare object, but is determined when the user accesses the record; query to those objects will return zero records. You can use UserRecordAccess or look at the AccountShare to determine access.

Reference:

• Faster Account Sharing Recalculation
• Faster Account Sharing Recalculation in Salesforce