Salesforce Fundamentals
What the platform is
Salesforce runs on a multi-tenant architecture: many orgs share infrastructure, and your customization is stored as metadata rather than compiled into a private server. Everything built declaratively is metadata that can be retrieved and deployed. Core vocabulary: an app is a collection of tabs; an object is a table; a field is a column; a record is a row. Standard objects ship with the platform, custom objects and fields use the __c suffix, and every record carries a 15-character case-sensitive ID plus an 18-character case-safe version used by APIs and integrations.
The access model
Object and field permissions come from a profile (exactly one per user) plus any number of permission sets, which only add permissions and never subtract. Record visibility starts at organization-wide defaults, is widened by the role hierarchy (users see records owned by people below them when OWD is Private or Public Read Only), then by sharing rules and manual sharing. Roles grant record access, not object or field permissions.
Traps
- Swapping profile and role: the most common wrong answer on this domain.
- Assuming a permission set can remove access a profile granted.
- Treating OWD as a suggestion; it is the floor. You widen from it, you do not narrow below it.
- Confusing a sandbox's purpose with a production capability.
Rule of thumb
Cannot see it? Walk the ladder: object permission, then OWD, then role hierarchy, then sharing rule, then manual share. Cannot edit it? Stop at step one: profile or permission set field-level security.