Field-level security:
This lets you lock down individual columns, even if the user already has full access to the record itself. So someone could open an employee record, but a field like “Salary” stays hidden or read-only for them.
How it actually works — Field Security Profiles:
First, you turn on field-level security for a specific column (it’s off by default). Once that’s done, that field becomes invisible to everyone except users who are added to a Field Security Profile that grants access to it.
A Field Security Profile basically says three things for that field:
- Read – Can the user see the value?
- Update – Can the user change the value?
- Create – Can the user set the value when creating a new record?
You then add specific users or teams to that profile, and only they get the access defined in it.
Real example:
You have to secure the Salary column in the Employee table. For that create a “HR Salary Profile” that allows Read/Update access.
- Assign HR managers to that profile.
- Other users without the profile will see the field as blank or hidden.
Interview tip: A common follow-up question is “does the user still need a security role?” — yes, field security works on top of security roles, not instead of them. The user still needs record-level access first; field security just adds an extra layer on specific columns.
