I have always given users View All and Modify All permissions because it was crucial that every employee could see all data in our org. However, we have begun using Approval Processes as sort of multi-step-workflow so that we can track our business processes, and the Modify All permission is allowing people who are not assigned a step in the process to (mostly accidentally) approve/reject a step that they should have had nothing to do with.
What is the best way to prevent users from seeing the Approve/Reject button(I assume I need to get rid of the Modify All permission) without preventing users from viewing and editing any record that they need to see?
Thanks!
EDIT: Because of the way a previous administrator implemented the system, our default sharing for several objects is 'Private'. Will changing this to Public/Read Write fix this problem? Will it create any new problems I should be aware of ahead of time?
Best Answer
How about trying :
If the need is only for everyone to see all data, then View All should suffice. Get rid of the Modify All (except for maybe a full System Admin)
Granting View All and Modify All on a per object basis rather than blanket (on a need basis, or only View All to everyone but Modify All only to those Profiles that really need that permission)
Create a Public Group containing all the roles and create a sharing rule per object to share all data as Public Read Only with everyone in the group. This way they can see all data but only modify what is rightfully theirs to edit. (Or as @eyescream says Sharing Rule to share everything owned by the top role and internal subordinates with top role and internal subordinates as Public Read Only)