Enforce BU-Based Contact Access When Accounts Are Shared Across Business Units

Hi Everyone,

We have a requirement where Accounts need to be shared across all Business Units, while Contact access should be restricted based on the user's Business Unit.

We have configured BU-based Contact security using custom BU fields on Resources and Contacts with Access Groups, Custom roles and Data security policies. The Contacts Redwood List page is working as expected and only shows Contacts belonging to the user's BU.

However, since Accounts are shared across BUs, users can still navigate to Contacts belonging to other BUs through the Account Contacts panel (Accounts foldout page) and the Primary Contact DCL field (Accounts List page Contact column). These Contacts are not available from the Contacts List page, but users can still navigate to their Contact Details/Edit pages with Read/View access.