The sales managers at Universal Containers requested their teams to define each user's role on their accounts in order to provide an easy way to establish accountability and collaboration. Sales managers also requested that sales associates should only get the following permissions: 1. Read access to the accounts. 2. Read access to cases related to the accounts. 3. No access to deals related to the accounts. The sales associates may be granted access to opportunities when needed. Assuming the overall sharing model of the organization is Private and no sharing rules are configured on the Account object, how should an architect achieve these requirements?

Account Teams are the ideal solution as they are designed to grant a team of users record-level access to a specific Account and its related child records. By configuring an Account Team, an architect can define specific roles for each member (e.g., "Sales Associate") and precisely control their access levels for the Account, as well as its related Opportunities and Cases. To meet the requirements, the Sales Associate role on the Account Team would be configured with Read-Only access to Accounts, Read-Only access to Cases, and Private (no access) to Opportunities, all within a single feature.

B. Use Account teams and Case teams. No configuration required for the Opportunity object.

Case Teams grant access to a single Case, not all Cases related to an Account. Account Teams can already provide the required Case access, making Case Teams redundant and incorrect for this scenario.

C. Use Account teams and sharing rules to share cases with sales associates. No change required to the Opportunity object.

Sharing rules are criteria-based and grant broad access, which is not suitable for the requirement of granting access to specific users on specific accounts. Account Teams provide the necessary record-by-record access control.

1. Salesforce Help, "Account Teams": "An account team is a team of users who work together on an account... You can specify each team member’s role... and level of access to the account and its contacts, opportunities, and cases." This document confirms that Account Teams are the single feature designed to manage access to an account and its related standard objects.

2. Salesforce Help, "Set Up Account Teams": Under the section for setting up teams, the documentation details the ability to define team member access levels for Account, Contact, Opportunity, and Case. The available access levels for Opportunities and Cases are "Private," "Read-Only," or "Read/Write," directly enabling the solution described.

3. Salesforce Architects, "Record-Level Sharing: Under the Hood" (White Paper): This document explains various sharing mechanisms. It positions teams (Account, Opportunity) as a method for flexible, user-managed sharing on a record-by-record basis, contrasting them with the automated, criteria-based nature of Sharing Rules. This supports why Account Teams are appropriate and Sharing Rules are not.