• "Microsoft Dynamics CRM 2011 - Customization & Configuration - (MB2-866) Certification Guide - Chap. 3 - Page 63-65"
  Published by Neil Benson (Packt Publishing)
  http://www.packtpub.com/sites/default/files/9781849685801_Chapter_03.pdf

The entity-based security privileges define the actions that a user or team can perform on an entity. An entity-based privilege is defined as a combination of an entity action and access level.

Entity actions

The actions that a user can perform on an entity as follows:

• Create: User can create new records of an entity.
• Read: Users can view records of an entity.
• Write: Users can edit or update records of an entity.
• Delete: Users can delete records of an entity.
• Append: Users can associate records of an entity to another record.
• Append To: Users can associate another records to records of an entity.
• Assign: Users can assign records of an entity to another user or team.
• Share: Users can share records of this entity with another user or team.              

Often a combination of privileges is required to achieve an action. For example, to add a contact to an account, a user will require the read, write, and append privileges on the contact entity and the append to privilege on the account entity.

Access levels

The access level defines the scope of an entity action. The levels of access that a privilege can have for the user or team owned entities, such as the account or contact system entities, are as follows:

• None: No access to the privilege on any records.
• User: Access to the privilege on records that the user owns.
• Business Unit: Access to the privilege on records owned by any user in the user’s business unit.
• Parent: Child Business Units: Access to the privilege on records owned by any user in the user’s business unit or its child business units.
• Organization: Access to the privilege on records owned by any user in any business unit.

Sharing a record with a user who would otherwise not have access to the record, effectively creates an exception to the normal security configuration granted by the security role, security privileges, and access-level combination.

For the organization-owned entities, such as the product or contact template system entities, the only level of access are as follows:

• None: No access to the privilege on any records.
• Organization: Access to the privilege on records owned by any user in any business unit.

The task-based security privileges define the features that a user or team can use.

Examples of task-based privileges are as follows:

• Bulk Delete
• View Audit History
• Create Quick Campaign
• Override Opportunity Pricing
• Publish Articles
• Print
• Merge
• Export to Excel
• Sync to Outlook
• Create Own Calendar
• Execute Workflow Job

The task-based security privileges are either granted or denied. Access levels do not apply to most task-based privileges. Access levels apply to a few task-based privileges, such as the pricing override privileges, in the same way as the entity-based privileges.