What is Object-Level Security, Field-Level Security, Record-Level Security in salesforce?

Object-Level Security:

Using Object-level security we can prevent a user from viewing, creating, editing, or deleting any instance of a particular object type. We can specify object permissions in permission sets and profiles. Permission sets and profiles are collections of settings and permissions that determine what a user can do in the application.

Field-Level Security:

Using field-level security we can allow user to have access to an object while limiting their access to individual fields in that object. Using field-level security we can control whether a user can view, edit, and delete the value for a particular field on an object. Permission sets and profiles are collections of settings and permissions that determine what a user can do in the application.

Record-Level Security:

We can also control access settings for records.

To specify record-level security, we define organization-wide sharing settings, role hierarchy, and create sharing rules.

1) Organization-wide sharing settings:

For OWD refer article : What is OWD or Organization-Wide default in salesforce?

2) Role hierarchy:

Role hierarchy is a way to give wider access to a record. 

If we define a role hierarchy and check Grant Access Using Hierarchies checkbox it ensures that users higher in the hierarchy can always access the same data as users who are lower, regardless of the organization-wide default settings.

Important points to note:

• We cannot uncheck grant access using hierarchy for standard objects.
• If we uncheck grant access using hierarchy for the custom object than the user above the record owner will not be able to see record if OWD for an object is private.
• Although it’s easy to confuse permission sets and profiles with roles, they control two different things. Permission sets and profiles control a user’s object and field access permissions. Roles primarily control a user’s record-level access through role hierarchy and sharing rules.

3) Sharing rules:

Using sharing rules we can make exeption to organization-wide sharing settings for sets of users. Using sharing rules we share records to users for which they do not have access.

4) Manual sharing:

Sometime requirement is not consistent i.e we are not able to define certain group of users who needs access. Record owners can use manual sharing to give read and edit permissions to users who don’t have access any other way.

5) Apex managed sharing:

If sharing rules and manual sharing do not provide the required control, we can use Apex managed sharing. Apex managed sharing allows developers to programmatically share custom objects.