salesforce-enterprise-rbac

name	salesforce-enterprise-rbac
description	Configure Salesforce Profiles, Permission Sets, and Sharing Rules for enterprise access control. Use when implementing role-based access, configuring SSO with Salesforce, or setting up organization-wide sharing defaults. Trigger with phrases like "salesforce permissions", "salesforce RBAC", "salesforce profiles", "salesforce SSO", "salesforce sharing rules", "salesforce OWD".
allowed-tools	Read, Write, Edit
version	1.7.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","crm","salesforce"]
compatibility	Designed for Claude Code

Salesforce Enterprise RBAC

Overview

Configure Salesforce's multi-layered security model: Profiles (baseline permissions), Permission Sets (additive permissions), Roles (record visibility), Organization-Wide Defaults (OWD), and Sharing Rules.

Prerequisites

• Salesforce System Administrator access
• Understanding of your org's user hierarchy
• For SSO: Identity Provider (Okta, Azure AD, etc.) with SAML 2.0

Instructions

Step 1: Understand the Salesforce Security Model

┌─────────────────────────────────────────────────────────────────┐
│ Layer 1: Organization-Wide Defaults (OWD)                       │
│ Most restrictive baseline — controls default record access      │
│ Options: Private | Public Read Only | Public Read/Write         │
├─────────────────────────────────────────────────────────────────┤
│ Layer 2: Role Hierarchy                                         │
│ Users above in hierarchy see records of users below             │
├─────────────────────────────────────────────────────────────────┤
│ Layer 3: Sharing Rules                                          │
│ Grant access to groups of users based on criteria or ownership  │
├─────────────────────────────────────────────────────────────────┤
│ Layer 4: Manual Sharing                                         │
│ Record owner shares individual records                          │
├─────────────────────────────────────────────────────────────────┤
│ Layer 5: Profile / Permission Set                               │
│ Controls CRUD + FLS (which objects and fields users can access) │
└─────────────────────────────────────────────────────────────────┘

Key principle: Salesforce OPENS access, never restricts beyond OWD.
OWD sets the floor. Everything else ADDS access on top.

Step 2: Configure Profiles for Integration Users

// Query existing profiles
const conn = await getConnection();
const profiles = await conn.query(`
  SELECT Id, Name, UserType, Description
  FROM Profile
  WHERE UserType = 'Standard'
  ORDER BY Name
`);

// Best practice: Create a custom profile for API integrations
// Setup > Profiles > Clone "Standard User" > Name: "API Integration Profile"
// Set object permissions:
const integrationPermissions = {
  Account:     { : , : , : , :  },
  :     { : , : , : , :  },
  : { : , : , : , :  },
  :        { : , : , : , :  },
  :        { : , : , : , :  },
};


 userPermissions =  conn.();