The group sets Patient object-wide default sharing to Private so each clinic sees only its own patients. An Employee agent used by an operations manager who oversees all six clinics needs to query patients across every location. Granting the Agent User object-level "Read" permission alone is not enough. What else is required?
Select an answer to reveal the explanation.
Short Explanation
Object permission tells Salesforce "this user is allowed to read Patients, generally." Sharing tells it "...but only these specific Patient records." With Private OWD, you need both boxes checked, and granting only the first box leaves the agent seeing nothing outside its home clinic.
Full Explanation
Under a Private organisation-wide default, object-level permission and record-level sharing are two separate gates that both have to be satisfied: granting the Agent User Read at the object level confirms it may read Patient records in principle, but it still needs record-level access granted through a sharing rule, role hierarchy placement, or an equivalent sharing mechanism to actually see records outside its own clinic's ownership. Assuming object-level Read alone is sufficient ignores how Private sharing behaves for every user in Salesforce, human or Agent User alike, and is a common and costly misconfiguration. Switching the object-wide default to Public Read/Write to solve one agent's access need is a wildly disproportionate fix that exposes every clinic's patients to every user org-wide, trading a scoped problem for an organisation-wide security regression. And agent type has no bearing on whether sharing rules apply; there is no such thing as a Sales agent that bypasses the sharing model, since sharing is enforced at the platform's data layer regardless of which agent type is querying through it.