Restriction Rules Explained

Currently Salesforce allows you to create rules that restrict the visibility of records. For example, even if we have the OWD of an object to Public Read or beyond, we can still hide its records from certain users by adding a rule called "Restriction Rule".

Restriction Rules help us to restrict access to selected records from a group of users. It is made Generally Available (GA) since Winter '22 of Salesforce.  Remember that the restriction rule can only be created from the lightning experience and not from the classic experience.  We will take an example to illustrate each of its functionality, pros, and cons.

Scenario : I have a custom object named Engagement holding a checkbox field "Active".  The OWD for this object is "Public Read Only," but there are a specific set of Users belonging to profile "Sales Executive" who should be denied access to Engagement records where Active is TRUE.  Due to the OWD being "Public Read Only," the user cannot be restricted from accessing it.  

Solution : A Restriction Rule becomes relevant at this point. So let's create one to address the problem.   Restriction Rules are object-specific and so which we need to navigate to the object to create one.

Navigation : Goto Setup > Object Manager > Choose the object for which the Restriction Rule has to be created and on the left pane an option "Restriction Rule" will be available.(Refer to the below image for Reference).  Then click on "New Rule" 

There will be 3 sections here:

1. Rule Detail :

This will hold the details of the rule.  Populate values for all the fields under the section "Rule Detail".  Ensure to check the checkbox "Is Active". 

2. User Criteria :This is the place where we have to specify the Users for which

 the restriction Rule should apply. 

Currently, only two options are available :

   i. User Criteria

       If we want to identify users by a field on the User object 

       (only on the User object, multi-levels are not supported)
   ii. Permission Criteria 

      If we want to identify Users by using a "Custom Permission"

For our scenario, we wish to apply rule to all users associated with profile "Sales Executive".  But we need to understand the fact that the field Profile on User is a lookup and so only ID of the profile will be available on the User record.  As Restriction Rules can access data on the User object but not on the associated object, we have copy ID of the profile and use it in our criteria.

3. Record Criteria

It is here where criteria of records to be shown are specified. Any record that doesn't meet the criteria will be not shown to the User.  Only those fields on objects (on which restrictions are written) will be able to be selected.

For our scenario we wish to apply the Restriction for the Engagements where Active is unchecked. (Refer to below image for reference)

Save the record and you are all set.  Despite OWD being "Public Read Only", Engagement records with Active checkbox checked will no longer be visible to Users belonging to profile "Sales Executive".

It's definitely a useful feature, but it's equally important to know what the limitations are. Below are some of them.

• Restriction rules are not supported for all objects. Only custom objects, contracts, events, tasks, time sheets, and time sheet entries can be restricted.
• You can only have one Filter Entry under "User Criteria" and "Record Criteria". You cannot configure any Filter Logic and have multiple Filter Entries.
• Only "Equals" is available as "Operator" for sections "User Criteria" and "Record Criteria".
• Checkbox, Text, Number, Date, DateTime, Time, and Id(Lookup) are the only data types supported.  Only fields belonging toe mentioned data-types will be coming up in the User/Record Criteria

It feels like there are many limitations and I hope limitations will be lessened and scope will be extended in the upcoming releases.

Source : https://developer.salesforce.com/docs/atlas.en-us.restriction_rules.meta/restriction_rules/restriction_rules_about.htm  

Thanks for being such an awesome reader and I appreciate your feedback.

..Bazingaa..