Universal Containers has two types of applicants, hourly and salary. There are separate record types for each. While all members of the human…

The requirement is to grant a specific capability—creating 'Salary' applicant records—to a small subset of users (Hiring Manager, VP of HR) who are part of a larger group (HR department). The standard and most effective method for this is to use a permission set. The base profile for the HR department would not include access to the 'Salary' record type. A permission set would then be created that grants access to the 'Salary' record type and assigned only to the Hiring Manager and VP of HR. This approach adheres to the principle of least privilege and provides a scalable, manageable solution without altering profiles for one-off exceptions.

A. Sharing rules control access to existing records (visibility), not the ability to create new records of a specific type.

C. This is too restrictive. Removing object-level "create" permission would prevent users from creating any applicant records, including the required 'Hourly' type.

D. This is a user-training solution, not a security control. It does not prevent a user from manually selecting the 'Salary' record type if their profile permits it.

1. Salesforce Help Documentation, "Permission Sets": "A permission set is a collection of settings and permissions that gives users access to various tools and functions. The settings and permissions in permission sets are also found in profiles, but permission sets extend users’ functional access without changing their profiles." This supports using a permission set to grant additional, specific access.

2. Salesforce Help Documentation, "Assign Record Types to Users": "You can assign record types to users in their profiles or permission sets... Permission sets are the recommended way to assign record types because you can reuse smaller permission set building blocks to assign permissions to different types of users." This directly validates that permission sets are the best practice for this specific scenario.

3. Trailhead, "Data Security" Module, "Control Access to Objects" Unit: This unit clarifies the distinction between different security controls. It states, "Object-level access is the simplest way to control which users have access to which data... you can prevent a user from seeing, creating, editing, or deleting any instance of a particular type of object." This confirms that create access is an object-level permission, which can be refined by record type access within a profile or permission set, distinguishing it from record-level sharing (Option A).