The finance team at Universal Containers usually does not have access to account and contact records. A finance analyst was temporarily given opportunity access for a big deal to help with tax calculation. However, she can now also access account and contact records. What is causing this issue?

Salesforce has a built-in sharing behavior known as implicit sharing. When a user is granted access to a child record, such as an Opportunity, Case, or Order, they automatically receive implicit, read-only access to the parent Account record. In this scenario, giving the finance analyst access to the Opportunity record triggered this child-to-parent implicit share, granting her access to the associated Account. The subsequent access to Contact records is a consequence of this Account access, assuming the Contact's organization-wide default is 'Controlled by Parent'.

B. Account records can be accessed due to Role Hierarchy.

Role hierarchy provides vertical access based on a user's position in the hierarchy, not access to a specific, individual record.

C. Contact records can be accessed due to implicit sharing from Opportunity.

This is an indirect effect. The primary implicit share is from the Opportunity to the parent Account. Access to Contacts is a result of gaining access to the Account.

---

1. Salesforce Help, "Implicit Sharing":

"If you have access to a child record, such as an opportunity, case, or order, you have implicit Read-Only access to the parent account." This directly confirms that access to an Opportunity grants access to the parent Account.

2. Salesforce Architect's Guide, "Record-Level Security":

Under the section for Implicit Sharing, the guide explains that access to child records like opportunities provides implicit read-only access to the parent account. This is a fundamental, non-configurable behavior of the platform.

3. Salesforce Help, "Organization-Wide Sharing Defaults":

This document explains the 'Controlled by Parent' setting for Contacts. It states, "A user can perform an action (such as view, edit, or delete) on a contact based on whether they can perform that same action on the associated account." This clarifies why access to the Account (from the Opportunity) subsequently grants access to the Contacts.