Beyond Roles and Profiles: A Hybrid Access Control Model for Granular Security in Salesforce CRM

In enterprise-level CRM systems such as Salesforce, data security and access control are critical due to sensitive customer information and regulatory compliance requirements.Traditional Role-Based Access Control (RBAC) and Profile-Based Security models in Salesforce offer coarse-grained control that often leads to either over-permissioned or under-permissioned users.This research proposes a Hybrid Access Control Model (HACM) combining RBAC with Attribute-Based Access Control (ABAC) and Policy-Based Access Control (PBAC) to enable granular, dynamic, and context-aware access permissions.The paper presents an architecture that overlays Salesforce's native mechanisms with a modular security engine capable of interpreting context, roles, object-level and field-level constraints.The model is validated through simulated data leakage scenarios, highlighting reductions in exposure risk and unauthorized access compared to traditional models.