Salesforce explicitly recommends setting Organization-Wide Defaults for Case to Private when configuring employee and HR-service solutions containing sensitive information. A Private OWD establishes the restrictive baseline: users don't automatically receive access to another employee's HR Case unless access is subsequently provided through ownership, queues, public groups, sharing rules, or another authorized sharing mechanism.
Salesforce's HR data-protection guidance is particularly direct. HR Cases may include payroll, benefits, leave, employee-relations, disciplinary, and other sensitive information. Salesforce recommends that such cases be accessible only to the case owner and the appropriate HR agent or HR group. It also specifically warns against mirroring the organizational chart into the Salesforce role hierarchy because managers could otherwise inherit visibility into records owned by employees beneath them.
The Employee Concierge installation similarly configures the Case object's organization-wide default to Private , reinforcing this as the standard security model for employee service records.
Option A would potentially broaden sensitive-data exposure. Option C isn't the appropriate Case security mechanism for this requirement, and disabling approval processes has no relationship to baseline record confidentiality.
Study Guide Reference: Agentforce Public Sector Implementation Strategies and Best Practices – Employee Experience security; HR Service Center; Case sharing; Organization-Wide Defaults; least privilege.
================
