Customer complaints for bad interactions with a customer support agent are logged as Cases and assigned to a human resources representative. The agent of the complaint should not see the case, but their manager should. How is this accomplished?

This scenario requires a dynamic sharing solution where the recipient of the share (the manager) is determined by a user lookup field on the record itself (the agent of the complaint). Standard declarative sharing rules cannot accommodate this logic, as they share with predefined roles or groups, not with a user identified through a field on the record. Apex Managed Sharing is the appropriate tool for this requirement. A trigger on the Case object can identify the agent, find their manager via the ManagerId field on the User object, and then programmatically insert a CaseShare record to grant the manager specific access.

B. Criteria based Sharing Rule on Case that shares to the Role Manager and above when a custom field Assigned Agent (subject of the complaint) is not blank.

A criteria-based sharing rule cannot dynamically share a record with the specific manager of a user listed in a lookup field; it can only share with predefined roles or groups.

C. Case is owned by the subject of the complaint, so their manager in the role hierarchy can access the record. CRED permission are removed on Case so the agent cannot read the case record.

A record owner always has full access (Read, Edit, Delete) to their own records, regardless of object-level permissions on their profile. It is impossible to prevent an owner from reading their record.

1. Salesforce Apex Developer Guide, "Sharing a Record Using Apex": This guide explicitly states, "Use Apex managed sharing if... The sharing requirements are based on the record’s data... For example, a custom object has a lookup field to a user, and that user must have access to the record." This directly matches the scenario.

2. Salesforce Security Guide, "Data Access and Security": This document details the different levels of data access. It confirms that record owners have implicit full access. Under the "Record-Level Access" section, it clarifies that ownership grants View, Edit, Transfer, and Delete permissions, which cannot be revoked by object permissions.

3. Salesforce Help, "Create a Sharing Rule": The documentation for creating sharing rules shows that the "Share with" options are limited to Public Groups, Roles, Roles and Subordinates, and Territories. There is no option to select a user based on a lookup field from the record being shared.

4. Salesforce Architects, "Record-Level Access: Under the Hood" Whitepaper: This paper discusses the different sharing mechanisms. In the section on Programmatic Sharing, it highlights its use for complex sharing rules that cannot be implemented declaratively, such as when access is granted to users referenced in lookup fields on a record. (See Figure 5: Sharing Mechanisms and Common Use Cases).