The correct design uses Salesforce ' s Organization-Wide Defaults to establish different baseline visibility for customer records and sensitive financial records.
Person Accounts should have Public Read Only visibility so that users who have the required object-level permissions can view customer records throughout the organization. Public Read Only allows records to be viewed broadly while preventing unrestricted modification.
Financial Accounts contain sensitive information such as deposit accounts, investment accounts, loans, mortgages, credit cards, and other financial relationships. Their OWD should therefore be Private. With Private sharing, users do not automatically gain access merely because they can access the Financial Account object. Access can subsequently be expanded only to authorized users through record ownership, role hierarchy where appropriate, sharing rules, teams, manual sharing, Compliant Data Sharing, or other approved mechanisms.
Setting Financial Accounts to Public Read Only would expose them broadly and directly contradict the privacy requirement. Likewise, removing a Financial Accounts tab or component from a Lightning page is not a security mechanism. A user who retains record access could still retrieve the information through reports, search, APIs, related lists, or another Salesforce interface.
Therefore, Public Read Only for Person Accounts and Private for Financial Accounts provides the appropriate least-privilege foundation.
