Part 2 Study Guide: The File Cabinets: Sharing Records

The study guide for Part 2 of Securing Salesforce: Sharing and Visibility: eight chapters, from the org-wide defaults to proving the whole model with three users. Each chapter has its own study guide with the full checklist; this page puts them together by exam section.

About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.

How to Use This Page

Part 1 gave you the map of the file cabinets. Part 2 opens them, one way at a time, for the people inside your own company, and then proves who can open what. It teaches most of the biggest exam section, all of Access to Other Data, and the testing objective. Work through it in this order:

Finish each chapter, then tick off its own study guide.
Come back here and check each exam section below. If a line doesn’t feel solid, follow it back to its chapter guide.
Then do the two Steve Trucking checkpoints before you read my walkthroughs. If you can design the internal model and then prove it, Part 2 has come together.

By Exam Section

The weights come from the published exam guide. Check the current version before you book: Salesforce revises it.

Access to Records (39% of the exam)

Mostly Part 2. Sharing with external users (REC-8) and the record access overrides that take access away (the rest of REC-9) come in Part 3.

REC-1, org-wide defaults: the two rules (the most restrictive wins between the office and the cabinet, the most generous grant wins inside it); a record is Private if even one user mustn’t see it; what Private, Public Read Only and Public Read/Write each allow; the owner, a person, a queue or a system user, holding the first key; and who can see other users. Chapter 6.
REC-2, the role hierarchy: designed for access, not as an org chart; every role a level of data access and every move a recalculation; and how confidential records are kept from going to the top. Chapter 6.
REC-3, sharing rules: every rule has a source, a target and a level; criteria-based rules follow a value on the record, owner-based rules follow the owner; the field a rule reads is a security control; guest rules reach the whole internet; the limits per object and in all; go downward, or not; and every move of people is a recalculation. Chapters 7 and 8.
REC-4, groups: a public group grants nothing on its own; it’s a bucket you point rules, shares, folders and list views at, so one rule, one group, then change the group; and a shared list view shares the filter, never the records. Chapter 7, with groups as share targets in chapter 11.
REC-5, teams: account, opportunity and case teams, each with its own nuances, between rules and manual shares; and what survives an owner change, beside manual shares, territories and Compliant Data Sharing. Chapter 9.
REC-6, object relationships that support sharing: master-detail and Controlled by Parent decide a child’s access from its parent; the six kinds of implicit sharing; child access set on the account owner’s role; what implicit sharing costs on an account with too many children; and where it stops. Chapters 6 and 10.
REC-7, programmatic sharing: the last tool, not the first; when code is justified; the share record and its row cause; sharing with a bucket, not a person; two doors into one piece of logic; planning for the rules changing and for day zero; and doing all of it in a flow. Chapter 11.
REC-9, record access overrides, the part that gives access: View All and Modify All on one object, View All Data and Modify All Data on every object, finding everyone who holds them, and never testing as the admin. Chapters 6 and 10.

Access to Other Data (16% of the exam)

All of it is in Part 2.

OTH-1, data that isn’t a standard or custom object: two questions for every cabinet (who can open the container, and whose access fills what’s inside); files shared to wherever they go; Chatter groups, which aren’t public groups; report and dashboard folders, and the running user of a dashboard; Knowledge and its own model; calendars and events; CRM Analytics and row-level security; and big and external objects, which have no share table. Chapter 12.

Implications of Security Model Choice (18% of the exam)

Part 2 teaches testing. Sharing at scale (IMP-1) and the license limits for external users (the rest of IMP-2) come in Part 3.

IMP-3, testing the sharing model: three users for every requirement; the null test first; the permission set blocks, then the people, then the records; the expected result written before you log in; run-as tests on every deployment; the evidence and what each piece of it doesn’t show; and troubleshooting in the same order every time. Chapter 13.
The cost of the model, as you design it: access is calculated in advance, so moving roles, changing owners and reorganizing are expensive, and so is an account with too many children. This sets up IMP-1. Chapters 6, 8 and 10.

Permissions to Standard Objects, Custom Objects, and Fields (27% of the exam)

Taught in Parts 1 and 3. Part 2 keeps using it: a sharing rule’s level is the most it gives, and the user still needs the object permission to match. Chapter 8.

What changed since the exam’s Winter ‘23 alignment

The exam guide is aligned to Winter ‘23, and the platform has moved since. Every chapter guide in Part 2 ends with a dated list of what changed. Learn the behavior the exam describes, and know what’s different in an org today.

The Threads Through Part 2

Eight chapters, and a few ideas that keep coming back. If you can explain these in your own words, Part 2 has done its job.

Set each default for the user who mustn’t see. Then open up from there, one way at a time. Chapter 6.
Share with a bucket, not a person. Groups, roles, territories and teams change; the rules and the shares that point at them don’t have to. Chapters 6, 7, 8 and 11.
Every grant has a home. Most are rows in a share table, and the row cause says why. Some come from groups, the hierarchy or the platform itself, and the overrides leave no row at all. Chapters 6 and 10.
The field you share on is a security control. Who edits it, what fills it, and what a blank means decide who sees the record. Chapters 7 and 11.
Every move is a recalculation. A role moved, an owner changed, a group edited, a reorganization: plan each one like a sharing change. Chapters 6 and 8.
Ask what happens when the owner changes. Some access moves with the owner, some goes unless you keep it, and some stays. Chapter 9.
Have your implicits in mind. The data model and the platform share before you do. Chapter 10.
Code is the last tool, not the first. Walk the declarative ways first, and try the hybrid: code sets a field, a rule shares on it. Chapter 11.
Two questions for every cabinet. Who can open the container, and whose access fills what’s inside. Chapter 12.
Three users, and the null test first. Prove nothing is shared before you share anything, and prove the negative, not only the positive. Chapter 13.
AI raises the stakes. An agent’s user picks up every grant in Part 2, can share and reassign records in one step, and finds in seconds what a person might never look for. Chapter 20 covers agents.

Check Yourself

Each chapter’s study guide has its own Check Yourself questions. For Part 2 as a whole, the test is the two Steve Trucking checkpoints. Try each challenge first, then compare your reasoning with my walkthrough.

Checkpoint 1: design Steve Trucking’s internal sharing model: the org-wide defaults, a role hierarchy for the coordinators, regional managers and back office, the groups, rules and teams it needs, and what the data model shares on its own. Try the challenge, then read my walkthrough.
Checkpoint 2: build it, then prove it: a rule per Retail Partner, the manifests shared in a flow, the delivery photos and claim files on their records, and three users for every persona. Try the challenge, then read my walkthrough.

The chapter study guides:

Where You Are on the Exam

Two thirds of the way. You’ve designed the sharing for your own company and proved it. Next is Part 3: Beyond the Company and Beyond the Record: external users, taking access away, secure code, encryption and monitoring, agents, and sharing at scale. The course page shows the path.

Here’s the whole exam, and where each part of it is taught:

Exam section (weight)	Part 1	Part 2 (this part)	Part 3 (coming)
Access to Records (39%)	REC-1 to REC-9: the map	REC-1 to REC-7, REC-9: org-wide defaults and the hierarchy, rules and groups, teams and territories, overrides and implicit sharing, programmatic sharing	REC-8 and REC-9: external users, sharing sets and share groups, restriction and scoping rules
Permissions to Standard Objects, Custom Objects, and Fields (27%)	OBJ-1, OBJ-2, OBJ-3	—	OBJ-4 and OBJ-5: encryption and monitoring, secure Apex
Implications of Security Model Choice (18%)	Start of IMP-2	IMP-3: testing the model	IMP-1 and IMP-2: sharing at scale, external licenses
Access to Other Data (16%)	—	OTH-1: files, folders, reports and dashboards	—

After Parts 1 and 2, Access to Other Data and the testing objective are done, and Access to Records is covered for every user inside the company. Still to come are external users (REC-8), taking access away (the rest of REC-9), secure code (OBJ-5), sensitive data (OBJ-4), sharing at scale (IMP-1) and the external licenses (the rest of IMP-2). They’re in Part 3, which is being written now. Until it’s out, study them from the exam guide (opens in a new tab) and Salesforce’s own documentation. Part 1’s sections are in the Part 1 study guide.

Explore

Salesforce Certified Platform Sharing and Visibility Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07): the official list of objectives and their weights.