Sharing setup
Domain scoping runs on Salesforce record sharing, so it depends on two org settings that live in Setup rather than in the Studio tab. Both are on the ContextWorks Domain object. Check them once, after install.
Set the org-wide default
Setup → Sharing Settings → Domain → Organization-Wide Default: Private.
Install sets this. Confirm it anyway: the org-wide default stays yours to change at any time, and ContextWorks cannot change it back for you.
Private is what makes a grant mean anything. Left at Public Read/Write, every user holds every domain, every catalog is the full catalog, and nothing errors — the boundary simply isn’t there. The Access page reports which state the org is in, because nothing else shows it.
Clear Grant Access Using Hierarchies
Setup → Sharing Settings → Domain → clear Grant Access Using Hierarchies.
Left on, anyone above a domain’s owner in the role hierarchy reads that domain without ever holding a grant for it. Under the default fallback rule, that also takes them off the default domain.
This only matters when a domain’s owner has a role. Admins commonly have none, in which case the setting does nothing either way. The Access page names any domain owned by someone with a role, so you can tell which case you are in.
What install does for you
| Step | Done by |
|---|---|
| Create the General domain and add the default entities to it | Install |
| Share General with all internal users | Install |
| Set the Domain object to Private | Install, then yours to keep |
| Clear Grant Access Using Hierarchies | You, if it applies |
Install grants General to the organization-wide internal group, not to named users, so everyone inside the org reads it. Under the default fallback rule, giving someone a domain of their own takes General away from them.
After that, a reader needs only the ContextWorks User permission set.
What’s next
- Domain access — who gets which catalog.
- Access and cache — the health report.