When the organization-wide default is Private, access must be explicitly granted. A criteria-based sharing rule is the most appropriate mechanism to grant access to a specific subset of records, in this case, "high-value opportunities." Since the auditors are distributed throughout the organization and do not share a common role, a public group is the correct construct to group these users together. The sharing rule can then grant access to all records meeting the "high-value" criteria to the public group containing the auditors. This solution is precise, scalable, and adheres to the principle of least privilege.

B. Add the auditors to the default Opportunity Team.

This grants access to all new opportunities created by a user, not just the "high-value" ones, and does not grant access to existing records.

C. Put the auditors at the highest level of the Role Hierarchy.

This would grant excessive access to all opportunities and potentially other records owned by users below them, violating the principle of least privilege.

---

1. Salesforce Help Documentation, "Create Sharing Rules": This document details the process and use cases for sharing rules. It states, "You can create rules to grant wider access to data for particular groups of users... A criteria-based sharing rule determines with whom to share records based on field values." This directly supports using criteria (e.g., Amount > X) to share records with a specific group.

Source: Salesforce Help, "Create Sharing Rules," Section: "Criteria-Based Sharing Rules."

2. Salesforce Help Documentation, "Manage Public Groups": This resource explains the function of public groups. It notes, "Public groups are a way to group users... regardless of their role or territory assignment." This confirms that a public group is the correct tool for grouping the "distributed" auditors who do not share a common role.

Source: Salesforce Help, "Public Groups," Section: "Set Up Public Groups."

3. Salesforce Architect's Guide, "Record-Level Security": This guide compares different sharing mechanisms. It positions sharing rules as the primary tool for opening up access horizontally and conditionally when the role hierarchy is insufficient. It states, "Use sharing rules to grant record access to users in public groups, roles, or territories... when you need to grant access based on a record’s field values."

Source: Salesforce Architects, "Architect's Guide to Record-Level Security," Section: "Declarative Sharing."

4. Salesforce Help Documentation, "Controlling Access Using Hierarchies": This document explains the limitations of the role hierarchy for this scenario. It clarifies that the hierarchy grants vertical access to all records owned by subordinates, which is too broad for the requirement of accessing only "high-value" opportunities.

Source: Salesforce Help, "Controlling Access Using Hierarchies."