Published at: 2026-09-17

Data permission troubleshooting guide

Diagnose and resolve data permission issues in Setup, such as invisible records, failed edits, and ineffective sharing.

Overview

💡 Data permission issues usually result from layered authorization, disabled entities, or delayed rule calculation. This guide provides a standard troubleshooting path and solutions for common issues so administrators can restore data visibility quickly.

Before you begin

[!IMPORTANT] - Before troubleshooting: Before changing permissions, confirm the record Status, owner, and Assigned Department. - Primary tool: Always start with the Data Permission Query Tool.

Diagnostic flow

graph TD
    A["User reports no data access"] --> B["Check list and detail function permissions for the object"]
    B -- "No function permission" --> C["Assign function permissions through a business role"]
    B -- "Has function permission" --> D["Run the Data Permission Query Tool"]
    D --> E{"Analyze authorization source"}
    E -- "Owner is in a child unit" --> F["Check the Reports To value"]
    E -- "Assigned to a department" --> G["Check department data visibility"]
    E -- "Matches a sharing rule" --> H["Check that the rule is enabled and includes child departments"]
    E -- "Process handler" --> I["Check temporary permission status and start time"]

FAQ and checks

1. Department managers cannot view child department data

Checks:
1. Confirm the record’s Assigned Department. Department manager permissions depend on the record’s department, not the owner’s Primary Department.
2. Confirm that the record’s Assigned Department is within the manager’s administrative subtree.
3. Confirm that the department is enabled. After a department is disabled, the system disables related inherited permissions for its manager and assistants.

2. A sharing rule does not take effect

Owner-based sharing: The record must have a valid owner. The rule does not apply when the owner field is empty.
Department-based sharing: The rule becomes invalid when the source department is disabled.
Recipient scope: If recipients cannot view child department data, confirm that Include Child Departments is selected.
Criteria sharing delay: After enabling or changing a criteria rule, recalculation usually completes within 2 hours. Accounts without an owner do not participate unless the relevant feature flag is enabled.

3. Restrictions for special objects

Check these object-specific rules:

Child object: A child object in a master-detail relationship fully inherits permission from its parent. It is not displayed or configured separately in data permissions.
Account Pool accounts: These accounts are hidden from Related Teams members by default. Enable the Account Pool related-team visibility feature flag if needed.
Refund Request: After a refund, only the owner, the owner’s manager, and System Administrators can edit the record. Read/write permission does not override this restriction.
Personnel: CRM Administrators do not have access to personnel details by default. Grant access explicitly through data sharing or another permission method.
Sales records: These records use Standalone Configuration and independent permission logic. Contact the social collaboration support team when issues persist.

Fault Symptoms and troubleshooting summary

Symptom	Possible cause	Recommended solution
Child department data is hidden	Sharing or department permissions do not include child departments.	Select Include Child Departments in the sharing or department data permission configuration.
An approver cannot open a task	Temporary permissions are disabled, or the process instance predates the rule.	1. Enable temporary permissions. 2. For old records, add the handler to Related Teams with read-only permission.
Criteria sharing fails for some accounts	The owner or external owner field is empty.	1. Complete the owner information. 2. Request the feature flag that includes records without owners.