Restrict Admins to not to see anything related to specific domain

[madhuv]

Hi,

Ours is a domain separated instance; Segregated into TOP & child domains.

Admins switching (from domain picker) to TOP domain or Global domain can see the data in any child domains at the moment.

We have a special requirement now to restrict even admins to see some specific domain data & tickets. What is the best thing we can do to achieve it?

[boteeuwen]

For this requirement, I would not rely on domain separation alone, since users in the TOP or Global domain with admin access can normally see data from child domains.

I would protect the sensitive data with read ACLs and disable Admin override on those ACLs. The ACL can then check the record's domain and only allow access when the user has a specific role or meets another defined condition. This way, the restriction is still evaluated for users with the admin role.

A before query business rule can also be used to keep those records out of lists, reports, and other queries, but I would use that as an additional layer. The ACL should remain the main security control.

The important part is to control who has security_admin. Users with security_admin can modify ACLs, so they could change or remove this restriction. Regular admins should not be able to change these ACLs unless they also elevate to security_admin. Because of that, I would keep security_admin access limited to a very small group and make sure the people who must be restricted from this data do not have that level of access.

If this is a strict compliance requirement, I would also test the setup carefully in a sub production instance with the different admin, security_admin, and domain combinations.

If this helped, please mark it as the solution or helpful.