Custom Access Criteria

> Objects > {object} > Object Properties > [Edit] > Access Control > Custom Access Criteria

Custom Access Criteria lets you specify who can access/update/delete individual records, based on the data in the record, characteristics of the current user, and any other available information.

The Custom Access Criteria option is enabled by your Service Provider. The default single sign-on setting on on-premises installation is Off. The default single sign-on setting on the cloud is On. (Contact Support to make changes.)

About Custom Access Criteria

Custom Access Criteria can be used in place of the standard Data Access Permissions. Custom Access Criteria defines a set of expressions, one for each action that can be taken on a record:

• Add
• Update
• Delete
• List View - defines a typical View
• Record View - displays a single Record

For each action, the Formula Builder is used to create an expression, using characteristics of the logged in User, field values, comparison operators, and Formula Functions. When the expression evaluates to true for a given user, the user has access to the record and can perform the action. (Specifying true for the expression value gives access to everyone.)

Learn more: Access Controls

Important: The System User (ID = 3) executes Rules. For Rules to function properly, any access-expression that specifies a value other than true should include loggedInUser.id = '3' in an OR condition.

Payroll Example

Records with a salary in excess of a certain amount can be made visible only to users in designated roles.

Inventory Example

In an inventory management system, all records in the Inventory Object are visible to everyone (all Users). However, the operational policy states that only users with a valid Cost center code for the Purchasing Department can Add, Update, or Delete Inventory records.

Although it is possible to design access controls based on standard Data Access Permissions, it could become a recurring, complex task; because users and teams are dynamic and change frequently, role- and team-based controls must be updated as the business structure evolves.

A better solution is to add custom access criteria, which would work as follows:

• On an add, update or delete action for any inventory record, verify that the user record contains a valid Cost center code from the Purchasing department, then display the records.
• On a view action (View a record or View a List of records), display the records.

Working with Custom Access Criteria

Users that have the Customize Objects permission can select Custom Access Criteria and build Access Control rules.

Add Custom Access Criteria

To add or edit Custom Access Criteria:

1. Go to > Objects > {object} > Object Properties
2. Click [Edit]
3. In the Access Control section, choose one of the following options:

   Role Based Permissions

   Default

   • Enforces Role- and Team-based access control (Data Access Permissions)

   Custom Access Criteria

   • If selected, Role Based Access Control is not enforced.
   • The "Criteria Builder" appears.

4. For each action a user can take, click in the expression box.
   The Formula Builder appears.
5. Use the Formula Builder to create a Boolean expression (one that evaluates to true or false).
   • The Logged In User can be evaluated.
   • Owner and Creator fields are available as criteria, where Owner is the Record Owner and Creator is the Record Creator.
   • Owner and Creator fields are not available in List View or Record View Actions.
   • Formula Functions can be used to build the expression.
6. Click the [Check Syntax] button to verify that the formula is valid and returns a Boolean value.

   Learn more: Formula Expressions

Considerations

• If the Custom Access Criteria option is enabled, then the Data Access Permissions are not enforced by default
• If the Custom Access Criteria is enabled and the action fields are empty, then all users have access to all records for all available actions
• Fields available to build criteria are:

• Fields in the Object
• Rollup Summary Fields
• Fields in the Users Object, including custom fields

• For Add and Update actions, the formula is evaluated using the new field values (i.e., values that are part of the add/update action, not the field values in the database prior to the action)

• When importing data into an object where Custom Access Criteria rules are specified, no validations are performed during the import. Any data can be imported, regardless of the Custom Access Criteria rules. The restrictions apply to other actions a user can take.