When to set Lightning access=GLOBAL in Managed Packages

Let's consider the following base scenario to answer your questions:

• you plan to use a contrib:parentComp component.
• contrib:parentComp has a child component contrib:childComp.
• contrib:childComp has 3 attributes globalAttr, publicAttr and privateAttr with the 'hinted' access levels.
• the contrib namespace does not belong to your org.
• your org has your own myns customized namespace (it could also be the default c namespace as long as it differs from contrib).

Back to your questions, here are the answers:

1. Only the parentComp component needs to be global if your want to use it in the myns namespace.

   • If childComp is public you cannot directly call it as a standalone in your myns code but parentComp will still work as expected.
   • If childComp is global you could call it directly in your myns code without using parentComp.

2. The same rule applies to aura:attribute. Let's consider for this answer that childComp is global.

   • If you use it in myns code, you can only access globalAttr.
   • If you use it in contrib code (in the org where the component was implemented) then, you can access globalAttr and publicAttr when declaring an instance of the component.

3. private attributes are used to hold internal component state that will not be shared with a parent component regardless of the namespace.

I hope that this clarifies the use of the different access levels.

The Developer's Blog on How to Design, Build and Publish Your Lightning Component for AppExchange states the following:

Development best practice is to specify access attributes manually from the start. If you are planning to contribute an application or component, remember to always use “global” access to expose functionalities.

For point number 1, as a best practice, always set component level access to GLOBAL if you wish to expose them.

For point 2, if you plan on making the attributes accessible through the .design file, you will need to set access to GLOBAL.

For point 3, It is recommended to set them to private if you don't plan on making them accessible by other components outside of the attribute’s namespace.

As mentioned in Attribute Access control and in Modularizing Code in Lightning Components

Both articles are worth reading.

Generally speaking:

• Global: Any component can access the value of this attribute.
• Public: Only components in the same namespace can set the value of this attribute.
• Private: Only this component can set the value of this attribute.