---
title: Access and sharing
description: "Which records a person sees beyond their own: access defaults, teams, sharing and restriction rules, sharing by hand, and field access per property."
url: https://salexhub.com/docs/control/access
type: reference
area: control
section: Control & audit
last_updated: 2026-10-06
prerequisites:
  - https://salexhub.com/docs/control/roles
related:
  - https://salexhub.com/docs/control/approval-rules
  - https://salexhub.com/docs/developers/webhooks
tools:
  - sharing.share
  - sharing.rule.create
  - restriction.rule.create
  - property.permissions.set
checked_against: salexhub/platform be080ea89
---

# Access and sharing

Which records a person sees beyond their own: access defaults, teams, sharing and restriction rules, sharing by hand, and field access per property.

A person sees the records their role allows: every record, their teams', or their own. Four things widen or narrow that, all in **Settings > Members & access**, and field access decides, on top, which values of a record they may read or change.

Only holders of the **Organization settings** right, Owners and Admins by default, set access defaults, sharing and restriction rules, field access, and share a record by hand.

## How a record's visibility is decided

In this order:

1. The role must hold the verb, such as View or Edit, on the object at all.
2. **View all** or **Modify all** opens every record, and skips restriction rules. Owners and Admins hold both.
3. A **Public** access default, or a role scope of All, opens every record of the object.
4. Otherwise the person sees records they own, records owned by their team tree, tasks assigned to them, unassigned records if their role includes them, and records a sharing rule or a manual share gives them.
5. Finally, **restriction rules** take records away.

Employee records, employments and leave requests take a rule of their own in place of steps 3 and 4: a person sees their own, their direct reports' and, as HR of a legal entity, that entity's.

Field access then applies on top of any record the person can see.

## Access defaults

**Access defaults** set the floor for each object: **Private** (the owner, their team and admins), **Public read** (everyone can view, the owner's scope edits) or **Public read/write** (everyone can view and edit).

Contacts, companies and deals start **Private**. Purchase orders, goods receipts and stock adjustments start **Public read/write**. A default opens records, not verbs: a role that cannot edit still cannot edit a public record. No access default opens records to the External role: it sees what it owns and what is shared with it.

## Teams

**Teams** form a hierarchy, and a parent team sees every sub-team's records: the Team scope covers records owned by anyone in your teams and their sub-teams. A sub-team does not see its parent's records. Adding people to a team or moving a team changes who sees what, so it needs **View all records** as well as the teams right.

## Sharing and restriction rules

**Sharing** has two kinds of rule:

- **Sharing rules** only add access. **Owner-based**: records owned by chosen people, teams or roles. **Criteria-based**: records whose values match a filter. Each shares **View** or **Edit** with a role, a team or a person, and can be paused.
- **Restriction rules** only take access away: a role, team or person may see only the records the rule names, even where ownership or a sharing rule would open more. Owners and Admins are never restricted; Viewers are.

## Sharing a record by hand

On a record, **More actions > Manage access** grants **View** or **View & edit** to a person, a team or a role. It is open to holders of **Organization settings**, and only for a record they can see.

## Field access

For each property, **Settings > Data > Properties**, the property's **Permissions** tab, **Field access** sets who may see and change its value:

| Level | On screen |
| --- | --- |
| **Edit** | Full read and write |
| **View** | Read-only |
| **Masked** | Sees a redacted hint, never the value |
| **Hidden** | The field does not exist for them |

A masked email reads like `a•••@e•••.com`, a phone keeps its last two digits.

- The rules name **Everyone else** and each role level: **OWNER**, **ADMIN**, **MEMBER** and **VIEWER**. Manager, Billing Admin and every custom role follow the MEMBER row; External follows the VIEWER row.
- A property with no rule is editable by everyone, so field access only narrows. Owners and Admins are held by it too.
- Identity and pipeline properties, such as a contact's first name and email, cannot be restricted, so records never become anonymous.

### Personal data starts masked

A property's **Sensitivity** is None, PII, Sensitive or Highly sensitive, and can only be raised. PII and above start masked for the VIEWER level. A new organization masks the built-in personal properties this way, such as a contact's last name, phones and birthday, and a company's tax ID.

### Where field access applies

| Where | What happens |
| --- | --- |
| Record pages, lists, boards | Hidden values are gone, masked ones show the hint, writes are refused |
| Search and filters | Masked and hidden values leave search; filtering or sorting on them is refused |
| Formulas and rollups | A value computed from a restricted property is restricted the same way |
| Exports | Masked and hidden columns are left out |
| Reports | Measuring or grouping by a property you cannot fully read is refused |
| Value history | Hidden values are dropped, masked ones show the hint |
| The Agent | It works as the person, with the same masks |
| Workflows | A workflow reads a masked value as its hint |
| Approvals | The decision page masks what the approver may not see |
| Webhooks | Deliveries follow the **Everyone else** rules |

Changes to field access, sharing and roles are recorded in the audit log's Security group.

---

The same page for people: https://salexhub.com/docs/control/access. Index of this site for agents: https://salexhub.com/llms.txt