The Problem: Unclear Access in Your Salesforce Org
"I don't really know who has access to what in my Salesforce Org, or why they have it."
This is one of the most common and most dangerous situations in Salesforce administration. Over time, access grows organically with no clear rationale or documentation, leading to:
Users holding dangerous system-level permissions
Sensitive data being overexposed
Overlapping permission sets creating unintended access
Manual, stressful audits
Getting Started: Connect & Sync Your Salesforce Org
Before you can analyse access, make sure your Salesforce Org is connected and synced.
Feature: Salesforce Sync (Salesforce Connect)
Support Guide: Connect and Sync Your Salesforce Org
💡 Important: The metadata dictionary is only as accurate as the latest sync. Always confirm sync status before analysing metadata.
Step 1: Understand Your Overall Level of Exposure
Start by surfacing the uncomfortable truths — dangerous permissions or excessive overlap that put your Org at risk.
Identify users with dangerous or high-risk system permissions — review who has Modify All Data, Author Apex, View All Data, or similar elevated rights.
Understand the level of permission overlap on key business objects, like Opportunity or Quote
Step 2: Plan Your Permission Management with Elements
Once you understand your exposure, use Elements to plan how to address it.
Use process mining to understand how vulnerable key processes are to bad data input and data exposure
Classify objects and fields that hold sensitive information and document who should have access to the data within
What You'll Discover
Working through these steps will shift your perspective from "Access is probably fine" to a clear, evidence-based understanding:
Which users hold dangerous system-level permissions you didn't know about
Whether your Org effectively allows anyone to do anything
Which users have access to sensitive data that doesn't match their role
How to use this insight to manage access more effectively going forward
Decisions You Can Now Make
With this visibility in place, you'll be able to:
Justify to management why investment in access management is needed
Quantify how vulnerable key processes are to bad data input
Remove or restrict dangerous permissions from non-essential users
Consolidate redundant permission sets into a cleaner structure
Redesign your access model around role-based or capability-based principles