Sharing-and-Visibility-Architect Exam Dumps - Salesforce Certified Sharing and Visibility Architect (SP23)

Implementing a third-party proxy server is the best technology to achieve the requirement of accessing on-premise information from Salesforce. A proxy server acts as an intermediary between Salesforce and the on-premise database, and it can handle authentication, encryption, and data transformation. Option A is incorrect, as tokenization is a technique to replace sensitive data with tokens, not to access on-premise data. Option B is incorrect, as it does not specify how Salesforce can connect to the on-premise database. Option D is incorrect, as Salesforce Shield is a set of tools to enhance data security and compliance in Salesforce, not to access external data sources.

 Criteria-based sharing rules are used to share records based on field values, not ownership. This is the best option to grant access to accounts of the same segment in other countries, regardless of who owns them. Owner-based sharing rules are based on the owner of the record, not the segment. Changing the role hierarchy would affect other aspects of data visibility and security. Creating a public group and a permission set would require manual maintenance and would not be scalable.

Public groups are used to grant access to a set of users who do not have a predefined relationship in the role hierarchy or territory hierarchy. Sharing sets are used for community users, not internal users. Role hierarchy is used to grant access based on the user’s position in the organization.

Public Groups and Roles and Subordinates are two options for sharing the List View with certain groups of users. Profiles and Manual Sharing are not valid options for sharing List Views

According to this source, Apex managed sharing is the best way to share records based on complex logic that can’t be handled by declarative sharing. In this case, the architect can use Apex code to create a trigger on the Job Interview object that will create a share record for the interviewer user when the lookup field is populated. The other options are not feasible or scalable.

Using a lightning component as an override for the “Edit” action on mobile view would allow field consultants to capture images while editing the case record, without affecting the desktop users. Using a lightning component as an override for the “Edit” action on lightning experience would affect both mobile and desktop users, which is not desirable. Creating a separate button for “Edit in Mobile” would require additional customization and user training.

Sharing the folders with the Sales Managers profile is the best way to grant access to sales managers to automate access to these Public Reports and Dashboard folder, as it allows admins to share folders with users who have a specific profile4. Sharing the folders with a “Sales Managers” Public Group will work, but it will require manual maintenance and may not reflect changes in roles or positions. Sharing the folders with the lowest rates in the Role Hierarchy will not work, as folders cannot be shared with roles or subordinates.

 Using a visualforce override or a custom LWC override for Opportunity view action will require additional development and maintenance, and may not be compatible with all devices. The best option is to use Dynamic Form to define different field sections applicable for different form factors of devices, as Dynamic Form is a declarative feature that allows admins to customize record detail pages without writing code.

The architect does not need to do anything to ensure field-level security is enforced on a custom Visualforce page using the standard lead controller. This is because the standard controller automatically enforces field-level security based on the user’s profile and permission sets. The user will only see the fields that they have read access to, and will only be able to edit the fields that they have edit access to

The two different approaches that the architect should consider when designing this enhancement are A and B. Option A ensures that the custom account team object data is consistent with the standard account team member object data, which is used for implicit sharing. Option B ensures that the account share object, which stores the sharing records for accounts, is updated based on the custom account team object data. The other options are either not necessary or not possible.

Apex sharing is a way to programmatically grant access to records for users or groups of users. Apex sharing can be used to share records with Customer Community Plus users, who are not supported by other declarative sharing options such as sharing sets or sharing rules. Apex sharing uses the Account__Share table to store the sharing information for the Account object. Therefore, the answer A is correct and the other options are incorrect

 Creating a Permission Set that grants “View All” permission for Opportunity is the best approach to meet the requirements. This will allow the Sales Reporting team to view all Opportunity records without changing their profile or OWD settings. Creating a Permission Set that grants “View All Data” permission would give them access to all data in the org, which is not necessary. Making Opportunity OWD read-only would affect all users in the org, which may not be desirable. Giving “View All Data” permission to the Sales Reporting Profile would also give them access to all data in the org, which is not necessary

Creating a criteria-based sharing rule that shares delivery records matching the Distributor to users of a Public Group created for the distributor is the correct solution for this scenario. This will allow all users at a distributor to access delivery records for all customer accounts associated with that distributor. Creating a Sharing set for the Distributor profile will not work, because sharing sets are only available for portal or community users, not internal users. Giving ownership of the delivery record to a distributor user will not work, because it will limit the access to only one user per record. Creating a criteria-based sharing rule that shares delivery records matching the Distributor to user distributor will not work, because it will not share records with other users at the same distributor.

Service reps will not be able to access all UC contact records if they are controlled by parent and service reps will not be able to access all UC account records because account OWD is private are two details that Salesforce Architects should consider in this scenario. Since service reps are assigned to a profile which has View All in Case object (Private OWD), they can access all case records regardless of ownership or sharing rules. However, this does not grant them access to related contact or account records, unless they have View All or Modify All permissions on those objects as well. If contact records are controlled by parent (account), their sharing settings will depend on the account OWD and sharing rules. If account OWD is private, service reps will only be able to access account records that they own or are shared with them. Implicit sharing does not apply to internal users. Option A and C are incorrect, since service reps will not be able to access all UC contact or account records due to the reasons explained above.

Setting the organization-wide default on Shipment to Private, creating a trigger to update the Account record with the shipment information, and using a lookup relationship to Account are the best recommendations to accomplish this requirement. This way, the Marketing team can see the shipment information on the Account record, but not the Shipment records themselves. Option A is incorrect, since setting the organization-wide default on Shipment to Public would give access to all Shipment records to all users. Option B is incorrect, since using a master-detail relationship to Account would inherit the sharing settings from Account, which may not be Private. Option C is incorrect, since using a master-detail relationship to Account and setting the organization-wide default on Shipment to Controlled by Parent would have the same effect as option B.

 Order, Asset, and Contact are the three objects that can be configured as “Controlled by Parent” in Sharing Settings when Person Account is enabled in a Salesforce organization. Controlled by Parent means that the sharing setting for the object is determined by the parent record. For example, an order’s sharing setting is determined by its associated account. Opportunity and Case are not objects that can be configured as “Controlled by Parent” in Sharing Settings.

List views are a way to filter and display records of a specific object based on certain criteria. List views can be shared with all users, a group of users, or only the owner of the list view. To share a list view with a group of users, such as sales executives who specialize in closing problematic deals, the architect can recommend creating a public group that includes those users and sharing the list view with that public group. Therefore, the answer B is correct and the other options are incorrect 

The license type that must be used by community users who want to collaborate on opportunities is Partner Community. As mentioned above, Partner Community licenses allow users to access standard CRM objects such as opportunities and collaborate with other partners and internal users using Chatter and Communities. Sales Community licenses do not exist as a separate license type. Customer Community and Customer Community Plus licenses do not allow users to access opportunities, as they are intended for customer service scenarios rather than sales scenarios.

Setting the Request object’s OWD to Public Read/Write is the simplest and most efficient way to allow all employees to collaborate on requests. Option B is incorrect, since granting Modify All Data permission on all profiles would give too much access and affect other objects as well. Option C is incorrect, since creating a criteria-based sharing rule to share all records with all users would be redundant and inefficient. Option D is incorrect, since setting the OWD to Public Read Only would not allow users to edit requests3.

 Deferred Sharing Recalculation allows the admin to postpone the recalculation of sharing rules until a later time, which can improve performance and avoid locking issues when changing role hierarchy or ownership. Parallel Sharing Rule Recalculation allows the admin to run multiple sharing rule recalculations at the same time, which can also improve performance and reduce downtime. Granular Locking enables finer-grained locking for certain operations that affect large data sets, such as bulk loading or updating. These features can help avoid problems when reorganizing roles and reassigning account owners. Therefore, the answer B, C, and E are correct and the other options are incorrect

A sharing rule is missing to share Accounts to the AR team, which could be the issue preventing AR team members from seeing invoices. Since invoice is a custom object with a master-detail relationship to account, its sharing settings are controlled by its parent account. If AR users do not have access to account records, they will not be able to see or query invoice records either. Option A is incorrect, since a sharing rule to share invoices to the AR team would not work, as invoice inherits its sharing settings from account. Option B is incorrect, since assigning an invoice page layout to the AR team profile would not affect their visibility of invoice records. Option D is incorrect, since giving read permission to the invoice object to the Accounts receivable profile would not grant access to invoice records that are owned by other users.

The OWD for pricebook should be set to Use, which means that users can only view and use price books that are shared with them. This way, sales agents can have access to products and create opportunities for their customers. Option A is incorrect, since Public Read Only would give access to all price books to all users. Option B is incorrect, since Public Read Write would give access and edit rights to all price books to all users. Option C is incorrect, since View is not a valid OWD setting for pricebook.

Role hierarchy is a way to grant access to records based on the user’s position in the organization. Users higher in the role hierarchy can access and edit records owned by users lower in the role hierarchy, unless the Grant Access Using Hierarchies option is disabled for a specific object. In this case, the Operations manager can access and edit all scheduled courses owned by the Operations Users team members who report to them in the role hierarchy. Therefore, the answer B is correct and the other options are incorrect

 Leveraging default Account team is the best way to help improve sales reps productivity by granting access to supporting internal users for customer records when they need help. Default Account teams are predefined groups of users who work together on an account. When a user creates or owns an account, Salesforce automatically adds the default Account team to the account team related list on the account2. Creating a permission set with “view all data” and assigning it to supporting users would give them too much access to data that they may not need. Creating a public group and replacing the account ownership with it would not be feasible or scalable. Creating a criteria-based sharing rule to grant access to other users would require manual maintenance and may not reflect the changes in the account team.

A sharing set is the best way to share cases with community users based on a common account. Sharing sets are available for Customer Community licenses and can grant access to related records using predefined criteria. Option A is incorrect, since sharing rules are not available for community users. Option B is incorrect, since there is no such thing as a share group in Salesforce. Option D is incorrect, since Apex sharing is complex and requires code maintenance

A new AccountShare record is created with Row Cause as “Manual” and Access Level as “Read/Write” when Paul manually shares the record with John. This record grants John edit access to the account owned by Paul. Option B is incorrect, since an existing AccountShare record is not updated, but a new one is created. Option C is incorrect, since the Row Cause is not “Owner”, but “Manual”. Option D is incorrect, since an existing AccountShare record is not updated, but a new one is created.

The Referral object OWD is public Read/Write, which could be the technical reason for the recruiter not finding the share button. When an object’s OWD is public Read/Write, all users can view and edit all records of that object, so there is no need for manual sharing. The share button only appears when an object’s OWD is private or public Read Only. Option A is incorrect, since the Referral object OWD is not private. Option C is incorrect, since the Referral object OWD is not public Read Only. Option D is incorrect, since public Full Access is not a valid OWD setting.

 Setting the OWD for internal users to Public Read Only is the simplest and most efficient way to give access to all internal employees to the ServiceFeedback object. Option A is incorrect, since creating a trigger on ServiceFeedback to change ownership to an internal employee would be complicated and affect the data quality. Option B is incorrect, since ensuring all the internal users are above the partners in the role hierarchy would not work, as the role hierarchy does not apply to partner users. Option C is incorrect, since creating an owner-based sharing rule for all ServiceFeedback records owned by partners would be redundant and inefficient

The architect can configure the system to support the requirements by using a sharing rule. A sharing rule is a declarative way of extending record access to users or groups of users based on criteria such as ownership, role, or field values3. In this case, the architect can create a sharing rule that grants read or read/write access to all records owned by customer community users to UC users in the customer support role. A sharing set is used to grant access to community users based on a common account or contact, not to internal users. A share group is used to share records with groups of community users who have Customer Community Plus or Partner Community licenses, not with internal users. Apex sharing is used to programmatically share records when declarative sharing cannot fulfill complex requirements, but it is not necessary in this case.

 To give access to the invoice records from an external object on the account page, the Sales Architect should recommend including the Invoice Related List on Account Page layout. This will allow the finance users to see the invoice records related to each account, as long as they have access to the account record and the external object4. Creating sharing rules or using Apex managed sharing are not applicable for external objects, as they do not support manual or programmatic sharing

 Account records can be accessed due to implicit sharing from Opportunity and Account records can be accessed due to role hierarchy are two reasons that could be causing this issue. Implicit sharing grants access to parent records when a user has access to a child record. For example, if a user has access to an opportunity, they also have access to its related account and contract records. Role hierarchy grants access to records owned by or shared with users who are below in the hierarchy. For example, if a user is above another user in the role hierarchy, they can access any records that the lower user can access. Option A is incorrect, since contact records cannot be accessed due to implicit sharing from account, as implicit sharing does not grant access to child records. Option C is incorrect, since contact records cannot be accessed due to implicit sharing from opportunity, as implicit sharing does not grant access to child records.

The license recommendation that will meet distributor needs is Partner Community. Partner Community licenses are designed for users who are not employees of UC, but are part of their partner ecosystem, such as distributors, resellers, or suppliers. Partner Community users can access standard CRM objects such as accounts, contacts, leads, opportunities, cases, and campaigns. They can also collaborate with other partners and UC employees using Chatter and Communities. Sales Cloud licenses are for internal sales users who need full access to standard CRM and custom objects. Customer Community Plus licenses are for high-volume customers who need access to standard CRM objects and custom objects, but not opportunities. Customer Community licenses are for low-volume customers who need access only to custom objects and a subset of standard CRM objects.

Reviewing the user provisioning process to not automatically create a user role for any new user and contacting Salesforce support and requesting to increase the number of users’ roles allowed are two recommendations that could solve this problem. Salesforce has a limit on the number of roles that can be created in an organization, which depends on the edition and the number of licenses. If this limit is reached, no more roles can be created unless the limit is increased by Salesforce support. Therefore, it is not advisable to create a new role for every new user, as this would quickly exhaust the limit and cause the “User Role Limit Exceeded” error. Option B is incorrect, since removing role hierarchy from Salesforce org and controlling the record access using Apex managed sharing would be a complex and custom solution that would not address the root cause of the problem. Option D is incorrect, since creating an Apex class to replace the User Roles by generic one as soon as they are created would be unnecessary and inefficient.

Setting the External OWD to Private for the Delivery object is the best approach to limit the records a distributor can see, since it will restrict the access to only the records they own or are shared with them. Option A is incorrect, since ownership-based sharing rules are not available for partner community users. Option B is incorrect, since removing Read permission from the distributor profile would prevent them from accessing any delivery records. Option D is incorrect, since criteria-based sharing rules are not available for partner community users.

Sharing the list views with the appropriate public group and sharing the list views with the appropriate role in the role hierarchy are two ways that UC can hide lists that are not relevant to an individual user. List view sharing allows users to share list views with other users based on public groups, roles, subordinates, or individual users. This way, users can only see list views that are relevant to them and their work. Option A is incorrect, since sharing list views with a queue is not possible. Option B is incorrect, since sharing list views with individual users would be tedious and inefficient.

Deleting the public link is the best way to ensure that the potential customers do not have access to the file after the meeting. Renaming the file, deleting the file, or moving the file to another folder will not affect the public link, which will still point to the file

The internal Pre-Sales users will no longer have access to the opportunity after the ownership transfer, since manual sharing is removed when a record owner changes. Option A is incorrect, since inherited sharing does not apply to manual sharing. Option B is incorrect, since implicit sharing does not apply to internal users. Option D is incorrect, since team access does not apply to manual sharing.

Creating a Share Group based on the sharing set created for the Customer Community User Profile is the best way to give support representatives access to Container and Case records owned by Customer Community users. Share Groups are groups of users who have access to records based on a sharing set. Sharing sets are settings that grant community users access to records that have a lookup relationship to their user record1. Creating an ownership-based sharing rule, creating a criteria-based sharing rule, and relying on the role hierarchy are not options that can achieve the same result.

The Apex method that must be used to make sure only allowed fields are shown to the users is isAccessible(). This method returns true if the user has read access to the field, and false otherwise2. isReadable(), isShowable(), and isViewable() are not valid Apex methods for checking field-level security.

The architect can achieve this requirement by using a permission set. A permission set is a collection of settings and permissions that give users access to various tools and functions3. The architect can create a permission set that grants edit access to the flag field on the case object, and assign it to the users who are assigned as case assessors. Object permissions control the access level that users have to records, not fields. A custom lightning component is not necessary for this requirement, as it can be done declaratively. Field-level security controls the visibility of fields on page layouts and reports, not the editability.

The most likely reason why some users cannot see the accounts shared with the public group is that their profiles do not have access to the account object. Sharing rules and public groups cannot grant access to an object that is not enabled by the profile. Option A is incorrect, since permission sets do not control record status. Option B is incorrect, since the role hierarchy does not affect sharing rules. Option D is incorrect, since page layouts do not affect visibility

Price books are a way to store different prices for products that can be added to opportunities. Price books can have different organization-wide defaults (OWD) settings that control the baseline level of access for users. To allow only specific branch staff to sell high risk products, the architect can recommend setting the price book OWD to View Only and sharing the high risk price book with the trained staff via manual sharing or sharing rules. Manual sharing allows the owner or anyone with Full Access to a record to share it with another user or group of users. Sharing rules allow the admin to automatically grant access to records based on certain criteria. Therefore, the answer A and C are correct and the other options are incorrect.

Removing order delete permission from profiles and permission sets is the best approach to ensure that order records cannot be removed from the system in the future. This way, only users with the Modify All Data permission can delete order records. Option A is incorrect, since removing the delete button from the order page layout would not prevent users from deleting order records using other methods, such as data loader or API. Option B is incorrect, since changing the record type/page layout assignment for orders to be read-only would not affect the delete permission, but only the edit permission. Option D is incorrect, since implementing a sharing rule that changes access for the records to read would not prevent users from deleting order records that they own.

The likely cause of this issue is that sales users profile does not have access to the remaining fields. Profile permissions determine what users can do with records, such as create, read, edit, or delete. If sales users profile does not have read permission for certain fields on the Invoice object, they will not be able to see those fields on the record detail page3. Page layout assigned to sales user profile, org-wide sharing settings, and role-based sharing are not likely causes of this issue.

SOQL injection is a vulnerability that can exist when controllers use dynamic rather than static queries and bind variables. SOQL injection is a technique that exploits a security vulnerability by inserting malicious SOQL statements into an existing query. This can result in data loss, data exposure, or unauthorized access1. Buffer overflow attacks, cross-site scripting, and record access override are not vulnerabilities related to dynamic queries and bind variables.

Using a trigger on Case to lookup and share to the manager of an Assigned Agent custom field using Apex Managed Sharing would allow the HR representative to control the visibility of the case based on the subject of the complaint. Criteria-based sharing rules cannot be used to exclude a specific user from seeing a record. Changing the owner of the case would affect other aspects of data visibility and security.

Three advanced tools that Salesforce can enable for large-scale role hierarchy realignments in organizations with large data volumes are partitioning by divisions, deferred sharing calculation, and skinny table indexing. Partitioning by divisions allows the organization to segment data into logical sections based on business criteria, which reduces the number of records that need to be recalculated when role hierarchy changes. Deferred sharing calculation allows the organization to postpone the sharing recalculation until a scheduled time, which avoids impacting users during peak hours. Skinny table indexing allows the organization to create custom indexes on frequently used fields, which improves query performance and reduces locking contention

 Partner User roles are limited to three levels, which means that affiliates cannot create more than three levels of roles for their internal sales team. This is the main problem an architect should address in this situation. The Channel Manager role can be shared with Partner Community, as it is used to manage partner accounts and users. Partner Community does support Role Hierarchy, as it allows affiliates to create their own roles and grant access based on their own hierarchy.

The two reasons that the architect should consider regarding the use of Apex sharing reasons are A and B. Option A allows the developer to more easily troubleshoot programmatic sharing, as they can identify which sharing records are created by which Apex code. Option B prevents the share record from being deleted upon ownership change, as Apex sharing reasons are not subject to recalculation by Salesforce. The other options are either incorrect or irrelevant.

The underlying issue for these users who don’t see any of the accounts that were shared with the public group is that they are in profiles that have no access to the Account object. If a user does not have Read permission on an object in their profile or permission set, they cannot access any records of that object, regardless of any sharing rules or manual sharing. The page layout assigned to these users does not affect their record visibility, only their field visibility and layout. The permission set that only allows accounts in Active status does not affect their record visibility, only their record filtering. The accounts being owned by users higher in the role hierarchy does not affect their record visibility, as sharing rules can grant access to records owned by any user in any role.

According to this source, cross-site scripting (XSS) is a security vulnerability that occurs when malicious code is injected into a web page that can execute in the browser of a user who views the page. In this case, the code snippet does not escape the output text value, which means that if the input text contains any HTML or JavaScript code, it will be rendered as such in the output panel. This could allow an attacker to execute malicious scripts on behalf of the user. The other options are not relevant to this code snippet.

 The optimal solution for an architect to recommend is to grant super user access to the lead agents as part of the community user setup. Super user access allows community users to access records that they do not own within their account or role hierarchy. This way, the lead agents can see the opportunities for all of the other agents at the dealer without changing the organization-wide defaults or creating any sharing rules

 Enforcement of a user’s record sharing is the functionality that is verified by the system method “runAs()”. This method allows test methods to run in the context of a specific user and verify whether that user has access to the records based on the sharing settings. The other options are not verified by the runAs() method.

According to this source, the runAs system method in test classes can be used to test using different users and profiles, and the with sharing keyword in Apex classes can be used to enforce record visibility rules. The other options are not valid keywords in Apex

Removing the “Opportunity Delete” permission from the sales team’s user profile in the object permissions is the best way to prevent a certain set of users from deleting opportunities, as it controls whether they can delete any opportunity record in Salesforce. Removing the delete button from the opportunity page layout and record type settings is not effective, as it only removes the button from the user interface, not from other access points such as API or reports. Creating a validation rule that checks the user’s profile before allowing the Is Deleted flag to be set to True is not possible, as validation rules cannot reference system fields such as Is Deleted. Overriding the standard button with a Visualforce page that warns them that they do not have permission to delete is not advisable, as it requires custom code and does not prevent deletion from other access points

The roles that Universal Containers has set for Partners users who will see records owned by partner users in roles below them in the hierarchy are Executive, Manager, and User2. These are the default roles that are created when you enable Partner Super User Access in Salesforce2. Partner Super User Access allows partner users to access records belonging to users in their account at their same role or lower in the role hierarchy, for Cases, Leads, Opportunities and Custom Objects.

The user will not be able to see the junction object records or the field values if their profile allows access to the Job object but not to the Production Facility object. This is because junction objects inherit the sharing and security settings from both master objects, and users need access to both master objects to access the junction object records. If a user does not have access to one of the master objects, they will not see any records or fields from the junction object

To share a report or dashboard folder with other users in the organization, you can use Public Groups or Roles4. Profiles and Teams are not available options for sharing folders.

Using Apex Managed sharing in a case Trigger that shares the record to the user identified in the Legal SME field is the best way to grant a lawyer access to a specific case when their assistance is needed, as it allows the case owner to dynamically share the case with a specific user based on a custom field value1. Creating a Criteria Based Sharing Rule that shares to the Corporate Legal Team Role when the ‘’legal assistance needed? Field is checked will not work, as it will share the case with all users in that role, not just the lawyer in the Legal SME field. Creating a Criteria Based Sharing Rule that shares to the Legal Public Group when the ‘’legal assistance needed?’’ field is checked will not work, as it will share the case with all users in that group, not just the lawyer in the Legal SME field.

The three options that can change the owner of the opportunity are B, C, and E. The current opportunity owner can transfer the ownership to another user by editing the record or using the change owner button. The system administrator or a user with the “Transfer Records” permission can also change the owner of any record, regardless of the sharing settings. Someone above the opportunity owner in the role hierarchy can also change the owner, as they have full access to the records owned by users below them in the hierarchy. The other options are either incorrect or not possible.

 Two options that Universal Health has to maintain compliance are updating the field type of each of the 12 fields to “Text (Encrypted)” so that they are encrypted at rest, and enabling Salesforce Platform Encryption and selecting the 12 contact fields to be encrypted. Both options allow Universal Health to encrypt PII data while it is at rest in Salesforce, and keep the fields accessible in Salesforce. The difference is that text (encrypted) fields have some limitations, such as not being searchable, filterable, or reportable, while platform encryption fields have fewer limitations but require additional licenses and setup

To troubleshoot why staff members can see accounts that they do not own and should not have access to after a change in the role hierarchy, the architect should log in as one of the staff members, navigate to a sample account, and use the sharing button to determine who has access. The sharing button shows all the reasons why a user has access to a record, such as role hierarchy, sharing rules, manual sharing, teams, etc. The architect can then identify which sharing mechanism is causing the issue and fix it accordingly

The Field Accessibility Viewer is a tool that allows you to see how a field is visible or editable for a specific profile or permission set. You can also see which page layouts and record types include the field. This is a quick way to determine the field accessibility settings for different users without logging in as each user profile or clicking on each profile.

 Enabling opportunity teams and allowing users to add the product manager is the best way to accomplish the requirement, as it allows for granular and flexible sharing of opportunities with specific users who are involved in the deal. Creating a sharing rule to allow the product manager to access the opportunity is not feasible, as it would require a criteria or an owner-based rule that would apply to all product managers and opportunities, not just specific ones. Enabling account team and allowing users to add the product manager is not sufficient, as it would only grant access to the account, not the opportunity. Using similar opportunities to share opportunities related to the product manager is not relevant, as it is a feature that helps users find and update similar opportunities based on fields and filters

Granular Locking is an advanced tool that allows admins to enable or disable locking behavior for specific objects when making changes to roles or account owners, which can improve performance and avoid locking issues for large-scale role hierarchy realignments1. Partitioning by Divisions is a feature that allows admins to segment data into logical subsets for reporting and searching purposes, but it does not affect role hierarchy realignments. Skinny Table Indexing is a feature that improves performance by storing frequently used fields in a separate table, but it does not affect role hierarchy realignments.

The Architect can support this request by creating a Permission Set with read-only access to the Category field and assigning it to the 3 users who need it. This will override the profile permissions and restrict their access to the field.