Visibility domains control what a specific user can see, while Contains domains control
what an entire domain of users can see.
Visibility domains is a related list on the user record that determines whether users from one
domain can access records from another domain. Granting users a visibility domain grants all the
rights they would normally have to the record based on ACL rule permissions.
A visibility domain:
- Is a user-to-domain relationship and is explicitly granted.
- Is not a child domain.
- Is not controlled by the selection in the domain picker. Once the user is granted access to
a visibility domain, they always see data in that domain and its children.
Note: Using visibility domains excessively is not recommended. Although visibility is one method
to allow users to access records, it is recommended that you use contains domains for more
Normally parent-child relationships define the domain hierarchy. A contains domain lets you
relate domains on an as-needed basis, independent of parent-child relationships. However,
contains domains only grant visibility to domain data. Processes remain unaffected by contains
A contains domain:
- Is a many-to-many, domain-to-domain relationship.
- May have child domains. When a domain is selected, you can see the data from that domain
and its children.
- Is controlled by the selection in the domain picker.
Contains domain example
A user has access to domain A (the user's home domain) and is granted visibility to domains B
and C. The user selects domain A in the domain picker. In this case, the user has access to
domains A, B, and C. If the user changes the domain picker to domain B, B and C are visible. C
is still visible because the user still has visibility to it. A is not visible, because it is
not selected in the domain picker and it is not a visibility domain.
Inherit visibility domains based on group membership
If you set the domain table to the Group [sys_user_group] table, users can inherit visibility
domains based on their group membership.
For example, as a member of the Database group, Don Goodliffe also automatically gains the
Database domain as a visibility domain. Group membership grants visibility to any matching