---
schema_version: "1"
id: 66f3df6e1dbc46bd9e40a5ddff00a10d93806be3409e98f112553d9c218a738d
title: Object, Field, and Record Level Security
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_data_access_policies.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_data_access_policies.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fde4fdfea5acba5045c1810ffedc3815d02b841f438b41732e42b11d4b0ee0fd
description: Data governance policies in Data 360 control access to data at different levels such as object, field, and row, based on user roles, attributes, or relationships.
products:
  - Data 360
release: "264"
---
# Object, Field, and Record Level Security

Data governance policies in Data 360 control access to data at different levels such as object, field, and row, based on user roles, attributes, or relationships.

## Examples

Here are some examples of the different levels of access that you can control.

- **Object-Level Security (OLS):** The Customer\_Orders object is accessible to users in the Sales department who are assigned to the appropriate data space.
- **Field-Level Security (FLS):** Hide the Credit Card Number field for users outside the finance team.
- **Record-Level Security (RLS):** Show customer records from a specific region to a user, or display only the records they own by comparing data from the protected object with attributes of the logged-in user. All supported attributes are Salesforce IDs stored in 18-character format:
    - User ID – Unique ID of the logged-in user
    - Role ID – User’s Salesforce role
    - Org ID – User’s Salesforce organization
- **RLS with Joins:** Extends record-level security by allowing access rules to reference external mapping or lookup tables, enabling more dynamic and context-aware access conditions. For example, you can create a permit access policy to allow users to access opportunity records if those records are owned by them or by someone in their reporting chain, based on the manager hierarchy.
- **RLS with Hierarchy**: Allows you to set access rules based on reporting structures from Salesforce CRM, such as manager or role hierarchies. You can create a policy rule so that a manager automatically sees records owned by them and their team, while team members can view only their own records.

- **[Create an Object or Field-Level Access Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_ols_fls_policy.htm&release=264.0.0&type=5)**  
    In data governance, define who can access specific data objects or fields based on user and data attributes. Create object-level or field-level access policies for users.
- **[Create a Record-Level Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_rls_policy.htm&release=264.0.0&type=5)**  
    Define who can access specific records within an object based on user and data attributes.
- **[Ingest Hierarchical Data](https://help.salesforce.com/s/articleView?id=data.c360_a_ingest_hierarchy_data.htm&release=264.0.0&type=5)**  
    Bring Salesforce CRM organizational hierarchies such as Role, Manager, and Territory into Data 360. After ingestion, you can reference these hierarchies in hierarchy-based record-level security (RLS) policies.