Managing user permissions with S-Docs: Best practices & considerations for Experience Cloud

Warning
S-Docs recommends exploring Salesforce User Management best practices before implementing in-package configuration options.

When configuring user permissions in Salesforce, following Salesforce best practices is crucial to ensuring data security while enabling users to perform their tasks effectively. Organizations should use profiles, permission sets, role hierarchies, and sharing rules to grant appropriate access levels, adhering to the principle of least privilege to prevent unnecessary exposure of data.

Quick reference: Salesforce best practices

Best Practice

Details

Use Profiles for Baseline Permissions

 

  • Assign profiles to users to define their baseline access.

  • Limit permissions based on job roles.

  • Use "Least Privilege" principle—only grant necessary permissions.

Utilize Permission Sets for Additional Access

 

  • Assign permission sets to grant extra access without modifying profiles.

  • Helps avoid excessive profile creation.

Leverage Role Hierarchies for Record Access

 

  • Define roles to control record visibility.

  • Higher roles inherit access from lower roles but do not override object-level permissions.

Implement Sharing Rules &
Organization-Wide Defaults (OWD)
  • Set OWD to restrict default access (Private, Read-Only, Read/Write).

  • Use sharing rules to grant additional access based on criteria.

Use Field-Level Security

 

  • Restrict visibility/editability of sensitive fields at the profile or permission set level.

  • Prevent unauthorized users from viewing/modifying critical data.

Manage Object & Record Access Separately

 

  • Object-level access: Controlled by profiles and permission sets.

  • Record-level access: Managed via OWD, role hierarchy, sharing rules, manual sharing, and Apex sharing.

Audit & Monitor User Permissions Regularly

 

  • Use the Setup Audit Trail and Field History Tracking for tracking changes.

  • Review User Access periodically.

Use Two-Factor Authentication (2FA)

 

  • Enforce Multi-Factor Authentication (MFA) for an extra security layer.

Minimize System Admins &
Special Permissions

 

  • Limit the System Administrator role to essential personnel.

  • Regularly audit users with “Modify All Data” and “View All Data” permissions.

Configuring Temporary elevated permissions for document generation in Experience Cloud

For Experience Cloud use cases that can’t be met through Salesforce permissions recommendations, temporary elevated permissions may be necessary. The S-Docs managed package provides flexible options to facilitate document generation workflows while still maintaining security controls. However, it is ultimately the responsibility of the Salesforce org administrator to properly configure user access when feasible. This ensures that data used within any document workflow is appropriately secured and does not unintentionally expose sensitive information.

System Mode configuration option

Configuring a temporary elevated permission for document generation is as simple as enabling a checkbox in the LWC or any of the SDK Generation Invocable Actions (Generate Document, Generate Document with User Input, and S-Docs Send Email).

System Mode configuration is not currently supported for the Generate Documents in Batch Invocable Action.

Configuration for S-Docs Lighting Web Component (LWC)

Learn how to set up the S-Docs Lightning Web Components (LWCs) for guest user generation use cases in Experience Cloud.

In the demo above, we have a Digital Experience site being constructed in Experience Builder. This page includes the two S-Docs LWCs that Guest Users will use to generate various documentation. 

Follow these steps to enable the Generate Documents LWC for guest user generation: 

  1. Click on the LWC to activate the configuration panel.
  2. Click the check box labeled System Mode Generation (Experience Cloud).
  3. The Generated Documents LWC follows the same path to configure for guest user access. Start by clicking on the component in the interface to launch the configuration options.
  4. Then, select the checkbox to give guest users the ability to use the functionality of this LWC.

The S-Docs LWCs are now ready for action!

Configuration for S-Docs SDK generation methods

The system mode configuration option remains visible in the flow builder experience, regardless of context, however when enabled, the setting will only be executable in experience cloud workflows. To configure, toggle on the System Mode Generation (Experience Cloud) option in any of the S-Docs invocable actions listed above and add the value of True to the value input field.

S-Docs SDK System mode Configuration Option

Enable this setting to allow unauthenticated or logged in guest users to generate documents with S-Docs. Attempting to run system mode in a flow operating within an internal org context will result in a failure to generate.

Warning
The System Mode settings are designed to function only in the context of Experience Cloud. Attempting to use system mode for generation in the internal org environment will result in an error.

Tags: , , , , ,

Was this helpful?