Accounts at Universal Containers are currently readable by all users but editable only by their owners. Management wants to designate some Accounts…

The fundamental principle of Salesforce's record-level security model is to start with the most restrictive setting and then grant wider access as needed. The requirement that VIP Accounts are only readable by their owners dictates that the Organization-Wide Default (OWD) for the Account object must be set to 'Private'. This action establishes the most restrictive baseline.

Once the OWD is Private, all accounts become visible only to their owners. To fulfill the second requirement—making non-VIP accounts readable by all users—a criteria-based sharing rule must be created. This rule will identify all accounts that are not marked as VIP and grant read-only access to a public group that includes all users.

B. Configure a permission set.

Permission sets grant object-level permissions (e.g., the ability to read Accounts) but do not control which specific records a user can see.

C. Set up an Account Team.

Account Teams are used to grant additional access to a single Account for a specific group of users, not for applying a broad access rule to all non-VIP accounts.

1. Salesforce Help Documentation, "Organization-Wide Sharing Defaults": This document states, "Organization-wide sharing settings specify the default level of access that users have to each others’ records... For the most restrictive access, set the default to Private." This supports the necessity of changing the OWD to 'Private' (Option D) to meet the VIP account requirement.

2. Salesforce Help Documentation, "Sharing Rules": This resource explains, "Use sharing rules to extend sharing access to users in public groups, roles, or territories. Sharing rules give particular users greater access by making automatic exceptions to your org-wide sharing settings." This directly supports using a sharing rule (Option A) to open up access for non-VIP accounts after the OWD has been restricted.

3. Trailhead, "Data Security" Module, "Control Access to Records" Unit: This module outlines the record access control hierarchy, emphasizing that OWDs are the first and most critical step. It clarifies that after setting a restrictive OWD, you use tools like sharing rules to grant wider access based on specific criteria, which is the exact pattern required by the scenario.