---
schema_version: "1"
id: cfa617a44d7f9958b992c859b84ec586aa4b60f090e9cc87b2602ec2e2cddc0c
title: Create a Restriction Rule
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/security_restriction_rule_create.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_create.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ca1d5f62a61eb763e48132c04b36cb705d8eeebb3983c6303cfaacda1b8f9a23
description: Control the records that a specific user group is permitted to see. When a restriction rule is applied to a user, the data that the user has access to via org-wide defaults, sharing rules, and other sharing mechanisms is filtered by the record criteria that you specify.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Create a Restriction Rule

Control the records that a specific user group is permitted to see. When a restriction rule is applied to a user, the data that the user has access to via org-wide defaults, sharing rules, and other sharing mechanisms is filtered by the record criteria that you specify.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d65978e72">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d65978e72 ">To create and manage restriction rules:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d65978e72 ">Manage Sharing</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d65978e72 ">To view restriction rules:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d65978e72 ">View Setup &amp; Configuration AND View Restriction and Scoping Rules</td>

          </tr>
        </tbody>
      </table>

Before creating restriction rules, we recommend that you [Turn Off Salesforce Classic for Your Org](https://help.salesforce.com/s/articleView?id=xcloud.lex_enable_users_disable_switcher.htm&type=5&language=en_US). Salesforce can't guarantee that restriction rules work as intended for end users who are in the Salesforce Classic experience.

Restriction rules are available for custom objects, external objects, quotes, contracts, events, tasks, time sheets, and time sheet entries. You can create up to 2 restriction rules per object in Enterprise and Developer editions and up to 5 restriction rules per object in Performance and Unlimited editions.

Only external objects created using the Salesforce Connect: OData 2.0, OData 4.0, and Cross-Org adapters support restriction rules. For more information, see [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&release=264.0.0&type=5 "Keep these considerations and limitations in mind while using restriction rules.").

1. In the Object Manager, click the object you want to create a restriction rule on.
    1. For an external object, enter External Data Sources in the Quick Find box in Setup, then select **External Data Sources**. Select an external object from the related list on this page.
2. In the sidebar, click **Restriction Rule**, and then click **Create a Rule**.
3. Enter the rule’s name and full name. The full name is the name of the component used by the API.
4. To have the rule take effect upon saving, select **Active**.
5. Under User Criteria, select which users this restriction rule applies to.
    - If the rule applies to a subset of users such as those in a given role, profile, or department, select **User Criteria**. Then, select the field to use as criteria.
        
        Set the Type field as **Current User** when the rule applies to the currently logged-in user.
    - If the rule applies to a subset of users with a custom permission, select **Permission Criteria**. To filter records for users with the custom permission, set the Boolean value to **True**. To filter records for users who don’t have the custom permission, set the Boolean value to **False**.
6. Under Record Criteria, select which records the specified users are allowed to see. For the Field value, you can reference another object’s field using dot notation.
    
    For picklist values, select a picklist field, and then click **Choose values**. For other field types, to designate more than one value in the record criteria, you can specify a list of comma-separated strings or 15-character IDs in the Value field.
    
    To include a single value that contains a comma, surround the value with double quotes (”).
7. Save the rule.
    
    ![The task object in the Object Manager appears with the Restriction Rules link selected and a rule called Open Tasks for Accounting Users shown.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/access/images/security_restriction_rules_create.png)
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/images/icon_note.png)
    
    Note Salesforce doesn’t validate that only one active rule applies for a given user. If you create two active rules, and both rules apply to a given user, only one of the active rules is observed. In this case, records that the user shouldn’t have access to could be accessible.

#### See Also

- [Enable Custom Permissions in Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_custom_perms.htm&release=264.0.0&type=5 "Custom permissions give you a way to provide access to custom processes or apps. After you’ve created a custom permission and associated it with a process or app, you can enable the permission in permission sets.")
- [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&release=264.0.0&type=5 "Keep these considerations and limitations in mind while using restriction rules.")