In step 1 to step 3, we created the business unit hierarchy and, in step 5 and step 6, we created a global security role to give users read access to all Accounts and Contacts.

Security roles are based on ownership. If a record belongs to a user from a sibling business unit, the reused security role from the previous recipe won't give you any access to it. However, the global read security role will give you read access.

The security roles and business units can work in a range of combinations. For instance, if a user belongs to the Packt business unit, then the Parent: Child Business Unit read role allows the user to read across the entire organization because the user is at the root level. However, if the user belongs to a child business unit, then they can only read records owned by users at their level (or below).