platform-sharing-owd-configure

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Managing Org-Wide Defaults

管理组织级默认（OWD）共享设置

Retrieve and update Organization-Wide Default (OWD) sharing settings for standard and custom objects in a Salesforce org. OWDs define the baseline level of access users have to records they do not own.

检索和更新Salesforce组织中标准及自定义对象的组织级默认（OWD）共享设置。OWD定义了用户对非自有记录的基准访问级别。

Scope

适用范围

In scope: Retrieving current OWD settings, updating internal/external access levels for standard and custom objects
Out of scope: Sharing rules, role hierarchy configuration, manual sharing, permission sets, criteria-based sharing — delegate to appropriate skills

包含范围：检索当前OWD设置、更新标准及自定义对象的内部/外部访问级别
排除范围：共享规则、角色层级配置、手动共享、权限集、基于条件的共享——转交给对应技能

Clarifying Questions

澄清问题

Before proceeding, confirm with the user if not already clear:

Which object(s) do you want to get or update OWD settings for?
What access level do you want to set? (Private, Public Read Only, Public Read/Write, Controlled by Parent)
Do you need to change both internal and external access, or just one?

在开始操作前，若信息不明确，请与用户确认：

您需要获取或更新哪个（些）对象的OWD设置？
您想要设置什么访问级别？（Private、Public Read Only、Public Read/Write、Controlled by Parent）
您需要同时更改内部和外部访问权限，还是仅更改其中一项？

Required Inputs

所需输入

Gather or infer before proceeding:

Target org: The org alias or username to query/update (use default org if not specified)
Object name(s): Standard object API name (e.g.,
```
Account
```
,
```
Contact
```
) or custom object API name (e.g.,
```
Invoice__c
```
)
Operation: Get (retrieve current settings) or Update (change access levels)
Access levels (for update): Internal access and/or external access values

Defaults unless specified:

Use the default connected org
If only one access level is provided, assume it applies to internal access

在开始前收集或推断以下信息：

目标组织：要查询/更新的组织别名或用户名（未指定时使用默认组织）
对象名称：标准对象API名称（例如
```
Account
```
、
```
Contact
```
）或自定义对象API名称（例如
```
Invoice__c
```
）
操作类型：获取（检索当前设置）或更新（更改访问级别）
访问级别（更新操作时）：内部访问权限和/或外部访问权限值

默认规则（未指定时）：

使用默认连接的组织
若仅提供一个访问级别，默认应用于内部访问权限

Workflow

工作流程

All steps are sequential. Do not skip or reorder.

所有步骤需按顺序执行，不得跳过或重新排序。

Phase 1 — Retrieve Current Settings

阶段1 — 检索当前设置

Query current OWD settings using the Salesforce CLI Tooling API:

bash

sf data query --query "SELECT QualifiedApiName, InternalSharingModel, ExternalSharingModel FROM EntityDefinition WHERE QualifiedApiName = '<ObjectName>'" --use-tooling-api --target-org <org>

For retrieving all OWD settings at once:

bash

sf data query --query "SELECT QualifiedApiName, InternalSharingModel, ExternalSharingModel FROM EntityDefinition WHERE IsCustomizable = true ORDER BY QualifiedApiName" --use-tooling-api --target-org <org>

Present results clearly — read
```
references/access_levels.md
```
for valid values and display a formatted table to the user.

使用Salesforce CLI Tooling API查询当前OWD设置：

bash

sf data query --query "SELECT QualifiedApiName, InternalSharingModel, ExternalSharingModel FROM EntityDefinition WHERE QualifiedApiName = '<ObjectName>'" --use-tooling-api --target-org <org>

一次性检索所有OWD设置：

bash

sf data query --query "SELECT QualifiedApiName, InternalSharingModel, ExternalSharingModel FROM EntityDefinition WHERE IsCustomizable = true ORDER BY QualifiedApiName" --use-tooling-api --target-org <org>

清晰呈现结果——阅读
```
references/access_levels.md
```
了解有效值，并向用户展示格式化的表格。

Phase 2 — Update Settings (if requested)

阶段2 — 更新设置（若用户要求）

Validate the requested access level — read
```
references/access_levels.md
```
to confirm the value is valid for the target object.

Retrieve the object metadata using the Metadata API (same command for both standard and custom objects):

bash

sf project retrieve start --metadata CustomObject:<ObjectName> --target-org <org>

This retrieves

<ObjectName>.object-meta.xml

containing

<sharingModel>

and

<externalSharingModel>

. See

references/metadata_api_approach.md

for the full procedure.

Modify the sharing settings — update the
```
<sharingModel>
```
(internal access) and/or
```
<externalSharingModel>
```
(external access) in the object's
```
.object-meta.xml
```
. Read
```
references/metadata_api_approach.md
```
for details.
Pre-deploy verification — before deploying, confirm:
- External access is not more permissive than internal access
- Objects with Master-Detail relationships use
```
ControlledByParent
```
- The requested access level is valid for the target object (see
```
references/access_levels.md
```
  )
- Cross-object constraints are satisfied (see "Cross-Object Constraints" in
```
references/access_levels.md
```
  )

Deploy the updated settings:

bash

sf project deploy start --metadata CustomObject:<ObjectName> --target-org <org>

Verify the change by re-running the query from Step 1.

验证请求的访问级别——阅读
```
references/access_levels.md
```
确认该值对目标对象有效。

使用Metadata API检索对象元数据（标准和自定义对象使用同一命令）：

bash

sf project retrieve start --metadata CustomObject:<ObjectName> --target-org <org>

此命令会检索包含

<sharingModel>

和

<externalSharingModel>

的

<ObjectName>.object-meta.xml

文件。完整流程请查看

references/metadata_api_approach.md

。

修改共享设置——在对象的
```
.object-meta.xml
```
文件中更新
```
<sharingModel>
```
（内部访问权限）和/或
```
<externalSharingModel>
```
（外部访问权限）。详细说明请查看
```
references/metadata_api_approach.md
```
。
部署前验证——部署前确认：
- 外部访问权限的宽松程度不超过内部访问权限
- 具有主明细关系的对象使用
```
ControlledByParent
```
- 请求的访问级别对目标对象有效（见
```
references/access_levels.md
```
  ）
- 满足跨对象约束（见
```
references/access_levels.md
```
  中的“跨对象约束”）

部署更新后的设置：

bash

sf project deploy start --metadata CustomObject:<ObjectName> --target-org <org>

验证更改——重新执行步骤1中的查询。

Rules / Constraints

规则 / 约束

Constraint	Rationale
Objects with Master-Detail relationships must use `ControlledByParent`	Platform enforces this — attempting other values fails
External access cannot be more permissive than internal access	Salesforce rejects configurations where external > internal
Some standard objects have fixed OWD (e.g., User, Activity)	Not all objects support OWD changes
Changing OWD to more restrictive triggers sharing recalculation	This can take significant time on large orgs — warn the user
Custom objects default to `Public Read/Write` when created	Users may not realize the default is permissive
Always verify the org connection before querying	Prevents confusing error messages

约束条件	理由
具有主明细关系的对象必须使用 `ControlledByParent`	平台强制执行此规则——尝试其他值会失败
外部访问权限的宽松程度不能超过内部访问权限	Salesforce会拒绝外部权限>内部权限的配置
部分标准对象的OWD是固定的（例如User、Activity）	并非所有对象都支持修改OWD
将OWD更改为更严格的级别会触发共享重新计算	在大型组织中这可能需要大量时间——需向用户发出警告
自定义对象创建时默认设置为 `Public Read/Write`	用户可能未意识到默认权限较为宽松
查询前始终验证组织连接状态	避免产生混淆的错误信息

Gotchas

常见问题

Issue	Resolution
`INSUFFICIENT_ACCESS` error when updating	User needs Manage Sharing permission or System Administrator profile
OWD change appears stuck	Sharing recalculation is running — check Setup > Sharing Settings for progress
Custom object not found in query	Use the full API name including `__c` suffix
`ControlledByParent` not available	Object has no Master-Detail relationship — use Private, Public Read Only, or Public Read/Write
External access field not showing	External sharing model only appears when external org-wide defaults are enabled
Query returns no results	Object may not be customizable or API name may be incorrect — verify spelling

问题	解决方法
更新时出现 `INSUFFICIENT_ACCESS` 错误	用户需要拥有Manage Sharing权限或System Administrator配置文件
OWD更改似乎处于停滞状态	共享重新计算正在运行——查看Setup > Sharing Settings以了解进度
查询中未找到自定义对象	使用包含 `__c` 后缀的完整API名称
`ControlledByParent` 不可用	对象没有主明细关系——使用Private、Public Read Only或Public Read/Write
未显示外部访问权限字段	仅当启用外部组织级默认设置时，才会显示外部共享模型
查询未返回结果	对象可能不可自定义，或API名称不正确——验证拼写

Output Expectations

输出预期

Deliverables:

For get operations: Formatted table showing object name, internal access level, and external access level
For update operations: Confirmation of the change with before/after comparison

交付成果：

获取操作：显示对象名称、内部访问级别、外部访问级别的格式化表格
更新操作：包含更改前后对比的确认信息

Cross-Skill Integration

跨技能集成

Need	Delegate to
Creating sharing rules after restricting OWD	`platform-sharing-rules-generate` skill
Deploying metadata changes to another org	`platform-metadata-deploy` skill

需求	转交给
限制OWD后创建共享规则	`platform-sharing-rules-generate` 技能
将元数据更改部署到其他组织	`platform-metadata-deploy` 技能

Reference File Index

参考文件索引

File	When to read
`references/access_levels.md`	When validating or explaining OWD access level values
`references/metadata_api_approach.md`	When using Metadata API to update OWD instead of Tooling API
`examples/get_owd_output.md`	To verify formatted output matches expected structure
`examples/update_owd_output.md`	To verify update confirmation matches expected structure

文件	阅读时机
`references/access_levels.md`	验证或解释OWD访问级别值时
`references/metadata_api_approach.md`	使用Metadata API而非Tooling API更新OWD时
`examples/get_owd_output.md`	验证格式化输出是否符合预期结构时
`examples/update_owd_output.md`	验证更新确认信息是否符合预期结构时