Access lookup: who can touch this?
The access lookup answers the reverse question: not "what can this user do?" but "who can do this?". It's the fastest way to answer audit requests like "list everyone who can read the SSN field" or "who can execute this Apex class?".
What you can look up
- A permission — e.g. everyone holding Modify All Data or Manage Users.
- An object — everyone with read/edit/delete access to, say,
Payroll__c. - A field — everyone who can see or edit one specific field.
- An Apex class — everyone allowed to execute it.
How to get there
- From any user's access page, click the item you're interested in.
- Or navigate from the org's Security Center pages directly.
The item's page shows:
- Summary tiles — users with access, high-risk holders, and how many profiles and permission sets grant it.
- Users with access — riskiest first, each with their profile, risk rating, and the exact grant ("Granted via").
- Granted by — every profile and permission set granting the item; click a component's source to see the captured definition behind the grant.
- For dangerous permissions, a risk explanation — one sentence on the impact and one concrete recommendation (e.g. for Modify All Data: keep it to system administrators, granted through a dedicated permission set).
- For objects, a fields section listing field-level access, sensitive-looking fields first.
[SCREENSHOT REQUIRED: Access page for a field showing users with access and the granting profiles/permission sets]
Typical workflows
Tightening a sensitive field
- Look up the field.
- Review the list — is everyone on it supposed to see this?
- For each unexpected user, the granting permission set is right there: remove or adjust it in Salesforce.
- After your next metadata capture, re-check the page to confirm the list shrank.
Preparing for an audit Walk your auditor's list of sensitive items one by one and record the holder list for each.