Overview

Field-Level Security (FLS) in Salesforce controls user access to individual fields on standard and custom objects. While object-level permissions determine if a user can view or manipulate records, FLS dictates which specific fields they can see or edit.

This guide explains how FLS works, how to configure it, and best practices for securing sensitive data.

---

🎯 Why Use Field-Level Security?

• Protect Sensitive Data (e.g., salary, SSN, credit info).
• Ensure Regulatory Compliance (e.g., HIPAA, GDPR).
• Limit Data Overload by hiding irrelevant fields from certain users.
• Enforce Business Rules by restricting edits to specific user groups.

---

🔍 How Field-Level Security Works

Field-Level Security can override object-level and record-level permissions. Here’s how:

Access Level	What It Does
Visible	User can see the field in UI, reports, API, etc.
Read-Only	User can see but not edit the field value.
Hidden	Field is completely inaccessible to the user.

⚙️ How to Set Field-Level Security

🔹 Method 1: Via Profiles

1. Go to Setup → Profiles.
2. Choose the desired profile.
3. Under Field-Level Security, select an object.
4. Click View beside the object name.
5. Adjust visibility and read-only settings for each field.
6. Click Save.

🔹 Method 2: Via Permission Sets

1. Go to Setup → Permission Sets.
2. Select or create a Permission Set.
3. Under Field Permissions, click the object name.
4. Set field access (Visible, Read-Only).
5. Save and assign the Permission Set to users.

🔹 Method 3: Via Field Settings (Object Manager)

1. Go to Setup → Object Manager.
2. Select an object (e.g., Contact).
3. Click Fields & Relationships.
4. Click the field name.
5. Click Set Field-Level Security.
6. Choose which profiles can see/edit the field.
7. Save.

🚫 FLS and Other Access Controls

Access Type	Controls	Can Override FLS?
Object-Level Access	Whether user can view object records	❌ No
Record-Level Access	Whether user can view/edit specific records	❌ No
Page Layouts	What’s displayed in the UI	❌ No — Hidden fields still won’t show even if added
API Access	External data access via integrations	✅ Controlled by FLS

✅ Best Practices

• Use Permission Sets for Flexibility: Easier to manage than editing multiple profiles.
• Audit Field Access Regularly: Especially for fields with sensitive data.
• Test with Login-As Feature: Simulate user access to verify FLS behavior.
• Avoid Page Layout-Only Security: Layouts hide fields in the UI but don’t secure them from API or reports.
• Restrict Create/Edit Fields Carefully: Fields like IsActive, Discount, or Salary should often be read-only or hidden.

📝 Summary

Field-Level Security ensures precise control over data visibility and edit rights at the field level. Combined with Profiles and Permission Sets, it forms a crucial layer in Salesforce’s security architecture, helping safeguard sensitive information while enabling efficient user access.