---
schema_version: "1"
id: ce302fc8c687480069ad3a0df7d5232dda3ba4dec01c8d4b0c6c79f4e59344b3
title: Row-Level Security Example Based on Role Hierarchy
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/sales_insights_role_hierarchy.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.sales_insights_role_hierarchy.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 07c0e84a4aefc02bca7c569c7be0eaabeb16d59a08585cec05ee92e97d9d7e8d
description: This policy leverages the Salesforce Role Hierarchy to allow managers/supervisors to view not only their own records but also the records belonging to their subordinates. This capability uses the specialized hierarchy operator in Data 360.
products:
  - Sales Cloud
release: "264"
---
# Row-Level Security Example Based on Role Hierarchy

This policy leverages the Salesforce Role Hierarchy to allow managers/supervisors to view not only their own records but also the records belonging to their subordinates. This capability uses the specialized hierarchy operator in Data 360.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with Sales with <strong>Agentforce 1 Edition</strong> or Agentforce for Sales Add-On license in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d20064e73">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">To manage <span>Data 360</span>:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">Data Cloud Architect</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">To manage Sales Insights:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">Sales Insights User permission set</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">To use Sales Insights:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d20064e73 ">Tableau Next Limited Consumer</td>

          </tr>
        </tbody>
      </table>

1. Determine which data DMO to include in the policy. The policy must be applied to the DMO being secured, linking its owner field back to the user/role structure.
    
    |  |  |
    | --- | --- |
    | DMO | ssot\_\_Opportunity\_\_dlm |
    | Description | The fact object containing sales opportunity details. |
    | Controlling Field (User Context) | ssot\_\_OwnerId\_\_c (Record Owner ID) |
2. Add Policy/Author
    
    1. In the Data Governance Policy Builder, create a new Data Policy.
    2. Select the DMO: ssot\_\_Opportunity\_\_dlm.
    3. Set the Action to Allow.
    4. Define the Condition using the hierarchy operator.
    5. Set the rule to Allow access to the record IF the logged-in user is hierarchically above the record owner in the Role Hierarchy.
        
        - **_Condition Logic (Conceptual Implementation):_** **_ssot\_\_Opportunity\_\_dlm.ssot\_\_OwnerId\_\_c Is Hierarchically Above In $Role Hierarchy_**
    
    Interpretation: Deny access to the record if the logged-in user's role is NOT hierarchically above the record owner's role, thus limiting visibility to the user's role and all roles above them in the hierarchy.