There may be individuals for whom you want to create user accounts but only with restricted access to a select number or type of records. For example, if your company has external vendors, you may want to provide the vendors with access to the specific project records with which they are involved.
Rights to work with either specific record types or all record types are set at the group level. At the user level, there is an additional setting (User type) that determines whether the user has access to all public records or limited access to records.
Note: If you need to allow limited-privilege users to perform tasks not normally available to them, such as the ability to approve an invoice, there must be a rule written that gives them record level rights to the invoice so that they can see it and approve it.
