Sales Configuration Template Access and Security

Sales Configuration Templates use a permission-set-based security model to control who can create, manage, apply, and delete templates. Three pre-defined permission sets map to distinct user personas, each with a specific level of access enforced at both the record and API levels. Trigger-based guards protect template deletion and that require all deletions to go through the official delete API.

Required Editions

Available in: Classic and Lightning Experience

Available in: Enterprise, Unlimited, and Developer Editions for CME managed package

Permission Sets and Personas

Three permission sets ship with Sales Config Templates. Assign the appropriate permission set to each user based on their role.

Permission set	Typical Users
`Template_Administrator`	System Admins, Deal Desk Admins, Template Configuration Managers
`Template_Golden_User`	Senior sales reps, Deal Desk Users, Power Users
`Template_Standard_User`	Sales reps, Account Executives, Inside Sales Users

What Each Permission Set Provides

Template_Administrator

The admin permission set provides full control over all template records in the org.

Full CRUD on all template records
View All Records and Modify All Records enabled
Access to all template Apex action classes at runtime

Template_Golden_User

The Golden User permission set is intended for power users who manage their own and shared templates, including drafts.

CRUD on own and shared records only
No View All or Modify All access
Access to all template Apex action classes at runtime

Template_Standard_User

The Standard User permission set provides read-only access limited to approved templates.

No Create, Edit, or Delete access
No access to draft templates

Apex Class Access Checks

Enforce Access to template operations at runtime through Apex action class checks. The following table shows which classes each permission set can invoke.

Apex Action Class	Template_Administrator	Template_Golden_User	Template_Standard_User
`CpqSalesConfigTemplateGetAction`	Allowed	Allowed	Allowed
`CpqSalesConfigTemplateSearchAction`	Allowed	Allowed	Allowed
`CpqSalesConfigTemplateApplyAction`	Allowed	Allowed	Allowed
`CpqSalesConfigTemplateSaveAction`	Allowed	Allowed	Denied
`CpqSalesConfigTemplateDeleteAction`	Allowed	Allowed	Denied

Template Deletion Protection

Template orders and quotes can’t be deleted directly and must be deleted that use the template APIs.

Important

All template deletions must go through CpqSalesConfigTemplateDeleteAction. Direct record deletion outside this API is blocked regardless of the user's permission level. Users who must delete templates must have the Template_Administrator or Template_Golden_User permission set assigned and must invoke the deleted operation through the official API.

Object-Level Permissions

The following table defines the object-level permissions for each permission set across all template objects.

Object	Permission Set	Create	Read	Edit	Delete	View All	Modify All
`SalesConfigTemplate__c`	Template Standard User	false	true	false	false	false	false
	Template Golden User	true	true	true	true	false	false
	Template Administrator	true	true	true	true	true	true
`SalesConfigTemplateTag__c`	Template Standard User	false	true	false	false	false	false
	Template Golden User	true	true	true	true	false	false
	Template Administrator	true	true	true	true	true	true
`SalesConfigTemplateTagLink__c`	Template Standard User	false	true	false	false	false	false
	Template Golden User	true	true	true	true	false	false
	Template Administrator	true	true	true	true	true	true

Considerations

These security configurations aren’t enforced by the product out of the box and need to set by org admin based on your access requirements.

Org-Wide Defaults (OWD): Recommend to set the OWD for vlocity_cmt__SalesConfigTemplate__c to Private as the most restrictive starting point, then use sharing rules to open access incrementally.
Sharing Rules: Criteria-based sharing rules that use the Status__c field can be used to control which user groups see approved versus draft templates.
Public groups: Public groups mapped to each persona simplify sharing rule management and make it easy to add or remove users without modifying rules individually.