A role in Salesforce places a user inside the role hierarchy — a tree structure that determines whose records the user can see by virtue of being above them in the org chart. Roles do not grant permission to do anything (that’s the profile’s job). They only influence record visibility when OWD is Private or Public Read Only and “Grant Access Using Hierarchies” is enabled for the object.
How the role hierarchy works
Picture a tree: CEO at the top, VPs underneath, directors under them, managers under directors, individual contributors at the leaves. When OWD for Opportunity is Private:
- Each user sees opportunities they own.
- Their manager’s role sees their own opportunities plus everyone below them in the hierarchy.
- The VP sees everything in their org. The CEO sees the entire company.
This is called implicit upward sharing through the hierarchy, and it happens automatically — no sharing rule needed — if “Grant Access Using Hierarchies” is checked for the object (it’s on by default for standard objects, configurable for custom objects).
What a role is not
- It’s not the user’s manager (
User.ManagerIdis a separate, lookup-only field used for approval routing — not record sharing). - It’s not a profile (profiles control CRUD/FLS).
- It’s not a permission set.
- It’s not required — a user can exist without a role, but on Private OWDs they’ll only see records they own or that are explicitly shared with them.
Key properties
| Property | Value |
|---|---|
| Required on a user? | No |
| Cardinality | One role per user, many users per role |
| Affects CRUD? | No |
| Affects FLS? | No |
| Affects record visibility? | Yes — through hierarchy |
| Used by sharing rules? | Yes — sharing rules can target roles or “role and subordinates” |
| Used by territory management? | Separate construct (territories), not the same as roles |
Common interview clarifiers
- Can two users have the same role? Yes. A role is a bucket — many users typically sit in the same node.
- Can a user have multiple roles? No. Exactly one role per user.
- Does the role hierarchy have to match the org chart? No, but in practice it usually does. The hierarchy is purely a sharing construct; it can be shaped however your record-visibility requirements demand.
- What if I disable “Grant Access Using Hierarchies” on a custom object? Roles still exist on the user, but they no longer influence visibility for that object. Managers stop seeing their reports’ records on that object unless a sharing rule explicitly grants access.
Verified against: Salesforce Help — Role Hierarchy and Sharing & Visibility Architect resources. Last reviewed 2026-05-17.