Salesforce Field-Level Security
What Is Field-Level Security?
Field-level security controls whether a specific field is visible, editable, or hidden entirely for a given profile or permission set, independent of whether the user can access the record itself.
Why It Matters
Object-level and record-level access answer "can this user see this record?" Field-level security answers a narrower question: "can this user see this specific field on a record they can already access?" This matters for sensitive data -- a support rep might need to see a customer's account but shouldn't see their contract value.
How to Set It Up
Decide whether you're setting this per-profile or per-permission-set (permission sets are generally the more maintainable choice).
Go to Setup, open the object's field, and click View next to Field-Level Security, or configure it directly within a permission set's Object Settings.
For each profile or permission set, choose Visible, Read-Only, or leave unchecked (hidden) for that field.
Save, then verify with a test user in that profile that the field actually behaves as expected on both the record detail page and any reports or list views.
Common Mistakes to Avoid
Field-level security doesn't apply to reports the same way it applies to record pages in every case -- admins sometimes assume hiding a field on the page layout is sufficient, when a user can still access it through a report unless field-level security is explicitly set. Page layouts control visual arrangement, not actual security -- confusing the two is the most common error.