Domain access
Sharing a domain decides what a user’s agents can discover. Share a domain to someone and their agents read what it serves. Share nothing and they read the default domain.
How it works
Share a domain to grant it. A user reads only the domains you share to them. Share to a user, a public group, a role, or a role and its subordinates — whatever your org already uses.
A scoped tool is the exception. It names its domain in Apex, so anyone who can run the class reads through it. Grant those classes as carefully as you share a domain.
General covers anyone you haven’t scoped. Installing the sample configuration creates General and shares it with every internal user. A user who holds no other domain reads General.
Share any other domain to them and General drops away: their agents can’t reach it even by name. Scoping a user takes one grant and nothing to revoke. The Domains page badges General Default. Rename it freely; the badge describes what the domain does.
A domain serves what’s on its roster. An entity reaches a user because a domain they hold rosters it. An entity on no roster reaches nobody, and the Access page lists those entities.
Setting someone up
| To… | Do this |
|---|---|
| Give a user the default catalog | Assign ContextWorks User. Nothing else |
| Limit a user to one domain | Domains → the domain’s Users button → add them |
| Let someone maintain a domain | The domain’s Managers button. They also need ContextWorks Domain Manager |
Any manager of a domain can open its Users and Managers buttons; an admin can open them on any domain. The Default domain is the exception: it reaches every user you scope to nothing else, so only an admin changes its reach.
Both buttons accept a user, a public group, a role, or a role and its subordinates.
Notes
Rosters need to be complete. A user scoped to Finance sees only what Finance rosters. If they still need Accounts, add the Account entity to Finance’s roster as well. An entity can sit in several domains at once.
An entity you have never activated reaches nobody, whichever domains carry it. → Versions
Prerequisite
Set the ContextWorks Domain object’s org-wide default to Private before you scope anyone. → Sharing setup