The access requirement is determined by the characteristics of the Financial Account records, not by who owns those records. Therefore, the administrator should use a criteria-based Financial Account sharing rule.
Criteria-based sharing rules allow Salesforce to identify records by field values and automatically extend access to a defined user population or public group. A criteria-based sharing rule determines record access by values on the record rather than record ownership.
For this design, the Financial Account data should contain a reliable attribute that identifies employee-only deposit products—for example, an appropriate product type, record type, classification field, or another controlled criterion. The sharing rule can then identify Financial Accounts matching that criterion and extend the required access to the specific customer-service group.
An Account sharing rule would be too broad because the employees themselves must continue to be serviced as ordinary customers. The sensitive information is the special Financial Account, not necessarily the entire customer Account. Similarly, an owner-based Financial Account rule is inappropriate because whether a deposit is an employee product is independent of who owns the Salesforce record.
Salesforce sharing rules create automatic exceptions to restrictive organization-wide defaults while preserving least privilege. A criteria-based Financial Account sharing rule therefore provides the required targeted access without unnecessarily exposing the employee ' s financial products to unrelated users.
