限制性规则：对Salesforce的记录访问控制机制的补充

If you’ve taken Salesforce Admin 201 training, you might remember learning about Sharing Settings. Sharing Settings include Sharing Models, Criteria Sharing Rules, Manual Sharing, and more. I’m a software engineer on the Record Access Experience team here at Salesforce. When I took this training in 2017, it was the first time Sharing Settings truly clicked for me, even though I’d been hired onto the team a month earlier. In this post, I’m going to talk about Sharing, then describe a new feature called Restriction Rules and how it’s implemented differently from other Sharing Settings.

如果您参加过Salesforce Admin 201培训，您可能记得学习过共享设置。共享设置包括共享模型、标准共享规则、手动共享等等。我是Salesforce公司记录访问体验团队的一名软件工程师。当我在2017年参加这个培训时，这是共享设置第一次真正让我感动，尽管我在一个月前就被雇用到这个团队。在这篇文章中，我将谈论共享，然后描述一个名为限制规则的新功能，以及它的实施方式与其他共享设置不同。

Sharing

分享

How Sharing Settings give you access to a record is described in this image.

共享设置是如何让你访问记录的，在这张图中有所描述。

How Sharing Settings give you access to records

共享设置如何让你访问记录

If a user gets access to a record because your Org’s Org-Wide-Default gives them access, Salesforce doesn’t check anything else. If not, we check to find out if your Role, Owner or Criteria Sharing Rules, or Manual Shares give you access. If none of these settings grant access, we return a “You don’t have access” message.

如果一个用户因为您的组织的Org-Wide-Default允许他们访问某条记录，Salesforce就不会检查其他东西。如果不是，我们会检查您的角色、所有者或标准共享规则或手动共享是否允许您访问。如果这些设置都没有授予访问权，我们会返回一个 "您没有访问权 "的消息。

Under the Hood: Sharing

引擎盖下：共享

Sharing works by materializing Share Rows in a table. For instance, if Maria owns an account, then we insert a row in an Account Sharing Table. The new row indicates that Maria can access the account because she’s the owner.

共享的工作原理是在一个表中实现共享行。例如，如果Maria拥有一个账户，那么我们在账户共享表中插入一行。新的行表示Maria可以访问该账户，因为她是账户的所有者。

The Accounts and Account Sharing tables with an Owner Share

具有所有者共享的账户和账户共享表

If a Sharing Rule grants access to another user, Frank, we insert a row in the Account Sharing Table. The new row indicates that Frank has access because it was granted manually. If a Sharing Rule grants access ...