To access a junction object record, a user needs to have at least read permission on one of its master records and on the junction object itself. If the user does not have access to either master record, they cannot access the junction object record. If the user has access to both master records, they can access the junction object record with the most permissive access level of either master record. Reference: https://help.salesforce.com/s/articleView?id=sf.security_sharing_rules_types.htm&type=5 https://help.salesforce.com/s/articleView?id=sf.relationships_manytomany.htm&type=5