Organization-Wide Defaults establish the baseline record visibility for users who otherwise have the required object-level permissions. To make Person Account records broadly visible, the Account or Person Account sharing model should provide Public Read Only access. Public Read Only allows all applicable users to view and report on records while reserving editing rights for users who receive additional access.
Financial Accounts contain sensitive financial information, so their baseline sharing should instead be Private. With Private sharing, users do not automatically gain access merely because they can access the Financial Account object. Access can subsequently be expanded only to authorized users through record ownership, role hierarchy where appropriate, sharing rules, manual sharing, Compliant Data Sharing, or another approved mechanism.
Setting Financial Accounts to Public Read Only would expose them broadly and directly contradict the stated privacy requirement. Likewise, removing a Financial Accounts tab or component from a Lightning page is not a security mechanism. A user who retains record access could still potentially retrieve the information through reports, search, APIs, related lists, or another Salesforce interface.
Therefore, the appropriate record-level model is Public Read Only for Person Accounts and Private for Financial Accounts, followed by selective access grants for authorized Financial Account users.
