Granular Locking is the platform capability associated with reducing group-membership lock contention during large changes to roles, groups, territories, and related sharing structures. A major role hierarchy realignment can cause many concurrent operations to update group membership and sharing tables. Without sufficiently granular locking, unrelated changes can be serialized behind broad locks, increasing the probability of contention and long-running maintenance operations. Granular locking narrows the scope of locks so unrelated hierarchy branches and group structures can be processed more independently where the relationships allow it. Divisions serve a different purpose: they partition data for organizational and reporting needs but do not solve group-membership locking during hierarchy maintenance. Skinny tables are database-performance optimizations and are unrelated to access recalculation. For enterprise-scale realignments, architects should also plan maintenance windows carefully and avoid overlapping major sharing, territory, role, and user-provisioning operations. Study Guide reference: Implications of Security Model Choice - enterprise-scale sharing, role hierarchy maintenance, group-membership locking, granular locking, and access-model performance.

Site User Visibility controls whether authenticated Experience Cloud users can discover other users who participate in the same site. Turning the setting off therefore affects searching for and seeing other external site users. The setting is part of the broader User-object sharing model, which is distinct from sharing business records such as Accounts, Cases, and Opportunities. It does not primarily control whether a user can edit the user ' s own profile, and it should not be interpreted as a general switch for internal-user search. Experience Cloud architects must treat user visibility as its own privacy problem because exposing the User directory can reveal names and other profile information even when business data is correctly isolated. The organization should therefore combine the User object ' s OWD and site/portal visibility settings with any required user-sharing rules according to the collaboration experience it intends to provide. Study Guide reference: Access to Other Data - User sharing, Site User Visibility, Experience Cloud user discovery, external-user privacy, and User-object access controls.

A sharing rule can extend record-level access only after the user has the fundamental object permission required to use the object. The affected users have no Read permission on Account, so membership in a public group and a sharing rule that exposes inactive Accounts cannot make those records visible. Salesforce evaluates security in layers: the license and object permissions establish whether a user can use an object at all; Field-Level Security controls individual fields; and record-level mechanisms such as OWD, role hierarchy, sharing rules, teams, and manual sharing determine which records are available. A page layout does not grant record or object access, and the position of the Account owner in the role hierarchy is irrelevant when the user ' s profile prevents Account access entirely. The administrator must first grant appropriate Account Read permission through the profile or a permission set, then allow the sharing rule to determine which Accounts the user can reach. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - object CRUD, profiles, permission sets, interaction between object permission and record sharing, and layered security evaluation.