Salesforce 通过四个层级来控制数据访问：组织级、对象级、字段级和记录级。
每一层的限制范围不同，从系统登录到具体数据可见性，层层递进。
| 层级 | 控制机制 | 作用 / 示例 |
|---|---|---|
| 1️⃣ 组织级（Organization Level） | 登录时间、IP 范围（Login Hours / IP Range） | 控制用户何时、从哪里可以登录，例如仅允许公司网络或工作时间访问。 |
| 2️⃣ 对象级（Object Level） | Profile / Permission Set | 控制用户对对象的 CRUD 权限（创建、读取、修改、删除）。例如：销售能编辑 Account，财务只能查看。 |
| 3️⃣ 字段级（Field Level） | 字段级安全（Field-Level Security） | 控制用户能否查看或编辑特定字段，例如对普通用户隐藏“薪资”字段。 |
| 4️⃣ 记录级（Record Level） | OWD、Role Hierarchy、Sharing Rules、Manual Sharing、Apex sharing | 控制用户能访问哪些记录。例如：OWD=Private，经理通过Role Hierarchy查看下属记录，Sharing Rules实现横向共享。 |
总结一句话：
Salesforce 的安全控制是自上而下的：
组织级控制“能否登录”，
对象级控制“能做什么”，
字段级控制“能看到什么”，
记录级控制“能访问谁的数据”。
Salesforce controls data access through four security layers — organization, object, field, and record level.
Each layer adds a different level of restriction, from broad system access to specific record visibility.
| Level | Mechanism | Purpose / Example |
|---|---|---|
| 1️⃣ Organization Level | Login Hours, IP Ranges | Controls when and where users can log in — e.g., restrict login to business hours or company network. |
| 2️⃣ Object Level | Profiles, Permission Sets | Controls CRUD access (Create, Read, Edit, Delete, View All, Modify All). For example, some users can edit Accounts, while others can only view. |
| 3️⃣ Field Level | Field-Level Security (FLS) | Controls whether users can view or edit specific fields, like hiding “Salary” from standard users. |
| 4️⃣ Record Level | OWD, Role Hierarchy, Sharing Rules, Manual & Apex Sharing | Controls which records users can see or edit, even if they have object access — for example, OWD = Private, managers see subordinates’ records through Role Hierarchy, and Sharing Rules expand access horizontally. |
In short:
Salesforce applies security top-down —
Organization sets who can log in,
Object defines what they can do,
Field limits what they can see,
Record controls which data they can access.
Q: “If a user has object access but can’t see some records, what’s the reason?”
A: It’s controlled by the record-level security (OWD, roles, sharing rules).
Q: “If a user has record access but can’t see a field?”
A: That’s field-level security (FLS).
Q: “How would you enforce these checks in Apex?”
A: Use
WITH SECURITY_ENFORCEDor Schema methods for CRUD/FLS validation.