Excessive data access privileges
Why is this an issue?
Granting View All Data or Modify All Data permissions at the profile level bypasses all sharing rules and record-level security. This creates significant security risks:
Users can access sensitive records they should not see
Audit and compliance requirements may be violated
Data breaches have wider impact
These permissions should only be granted to system administrators who genuinely need org-wide access.
Examples
Example of incorrect profile (View All Data enabled):
<Profile>
<userPermissions>
<enabled>true</enabled>
<name>ViewAllData</name>
</userPermissions>
</Profile>
Example of correct profile (object-level permissions):
<Profile>
<objectPermissions>
<object>Account</object>
<allowRead>true</allowRead>
<viewAllRecords>true</viewAllRecords>
</objectPermissions>
<!-- Grant View All only on specific objects that need it -->
</Profile>
How can I fix violations?
Review the permission necessity: Determine why this permission was granted.
Use object-level permissions: Grant View All or Modify All on specific objects rather than org-wide.
Use sharing rules: Create sharing rules to provide access to specific record sets.
Use permission sets: Assign elevated permissions via permission sets to specific users rather than entire profiles.
When should I disable this rule?
You may dismiss specific violations for:
System Administrator profiles that require full access
Integration user profiles that need org-wide data access for ETL operations
Resources