Universal Containers (UC) requested that branch managers and UC branch staff should only see customers and related information in their geographic…

This requirement calls for a horizontal data segregation model based on record criteria (geographic location). The standard and most effective Salesforce pattern to achieve this is a two-step process. First, establish the most restrictive baseline access by setting the Organization-Wide Defaults (OWD) for the Account object to 'Private'. This ensures users can only see records they own by default. Second, create criteria-based sharing rules to grant wider access. These rules will share Account records where the geographic location field matches the branch's location with the corresponding group of users (e.g., a public group for that branch).

A. Configure Role Hierarchy and create sharing rules.

This is incomplete. It omits the critical first step of setting the OWD to Private. Without a restrictive OWD, users might already see all records, making the sharing rules ineffective for restricting access.

B. Create the Account Team and add branch manager team members, and configure organization-wide defaults of the Account object.

Account Teams are designed for sharing individual records for collaboration, not for systematically sharing all records in a geographic area. This approach is not scalable and is the wrong tool for this requirement.

1. Salesforce Architects - Record-Level Security: In the "Record-Level Security (Who Sees What)" guide, the process is explicitly outlined: "Use organization-wide defaults to lock down your data to the most restrictive level, and then use the other record-level security tools to grant access to other users selectively." This directly supports setting OWD first, then using tools like sharing rules.

2. Salesforce Help - Organization-Wide Sharing Defaults: "Organization-wide sharing settings specify the default level of access that users have to each other’s records... For the most restrictive access, set the default to Private." This confirms that setting the OWD to Private is the foundational step for restricting visibility.

3. Salesforce Help - Sharing Rules: "Sharing rules give particular users greater access by making automatic exceptions to your organization-wide sharing settings." This documentation clarifies that sharing rules are used to open up access from the OWD baseline, which is precisely what is needed after setting the OWD to Private.

4. Salesforce Trailhead - Control Access to Records: The "Define Sharing Rules" unit states, "Sharing rules represent the exceptions to your organization-wide default settings... you can use sharing rules to grant them access to records they don’t own." This reinforces the relationship where OWDs restrict and sharing rules grant exceptions.