Permission Lens

Explains why a Salesforce user can or cannot see an object, field or record, with the evidence behind every answer.

Permission Lens answers the question every Salesforce admin gets asked: "Why can (or can't) this user see this?" Open the side panel on any Salesforce tab, pick a user, an object, and optionally a field and a record (detected from the page you're on). Permission Lens walks the whole access chain and explains it in plain English, with the Salesforce record that proves each step. WHAT IT CHECKS • Permission sources: profile, permission sets, permission set groups (with muting sets and stale groups flagged), session-based sets, expired assignments • Object access: Read / Create / Edit / Delete / View All / Modify All per source, plus the effective result, View All Data and Modify All Data • Field-level security: which sources give Read and Edit on a field, and whether the field is controlled by FLS at all • Record access: what Salesforce itself reports (UserRecordAccess) first, then why: org-wide defaults, owner, owning queue, role hierarchy, sharing rules, manual shares, account/opportunity/case teams, territories, Apex managed sharing, implicit parent/child sharing and Controlled-by-Parent records • Group membership: the exact path, e.g. User → Role → Role & Subordinates → Public Group → Sharing rule EVIDENCE YOU CAN VERIFY • Every claim links to the record or Setup page that proves it, with a copy button for each Id • "Show SOQL" reveals every query that was run • If the tool's reasoning ever disagrees with Salesforce's own UserRecordAccess, it says so loudly and tells you to trust Salesforce • "Copy report as Markdown" produces a write-up ready to paste into a ticket PRIVATE BY DESIGN • Uses the Salesforce session you are already logged into. No passwords, no connected app, no setup. • Read-only: it never changes anything in your org. • No data leaves your browser. The only network calls go to your own Salesforce org's API. • No analytics, no tracking, no remote code. REQUIREMENTS • You must be logged into Salesforce as an admin with View Setup and Configuration and View All Data (System Administrator has both). WHAT IT DOES NOT CHECK (YET) Restriction rules, scoping rules, record types and page layouts, Lightning page visibility filters, encrypted fields, and Experience Cloud sharing sets. ABOUT FIXHOLICS Permission Lens is built by Fixholics, a Salesforce consulting and implementation partner. We design, audit and fix Salesforce security models, from profiles and permission set groups to org-wide defaults and sharing rules, and deliver Sales, Service, Experience and Revenue Cloud, CPQ, OmniStudio and integrations. If an access question turns into a bigger project, talk to us at https://fixholics.com Permission Lens is an independent tool by Fixholics and is not affiliated with or endorsed by Salesforce, Inc. Salesforce is a trademark of Salesforce, Inc.