Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a flow in our org that accesses a few custom objects (create,update). These objects are not accessible to most profiles, and when those profiles try to run the flow it fails since they don't have access to the object. Is it possible to have the flow run as a more privileged user or does that break the current SF security model?

share|improve this question

You can call an Apex plug-in from the flow:

You could run this plug-in without sharing to allow the user to insert/update objects that they do not have access to. Write the plug-in to accept as input all parameters needed to perform the inserts and updates. Then in the apex plug-in you can insert or update records based on your requirements and return the object IDs or errors that returned from your DML operations.

I believe this is the only solution that will keep a pretty tight lock on your security.

share|improve this answer

Since this question was first asked and answered, this blog post addresses how to use Process Builder to launch a flow, which will then run in system mode.

share|improve this answer
Welcome to SF.SE Scott. While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference, giving credit to the author. Link-only answers can become invalid if the linked page changes. If you will, please update your answer with more information. – crmprogdev Nov 9 '15 at 15:45

Presuming you do not want to update your security model to give visual access (Tabs, Related Lists, etc.) to these users.

  • Give the user profile read/update/create access to the objects accessed by the flow
  • DO NOT give the user profile access to the tabs associates with the objects
  • Create page layouts that do not include related lists/lookups associated with the objects

This would give the user the ability to access the flow in question, from a home page link or button, but they would not be able to see any of the records associated to the flow in tabs, list views, etc.

The fields and objects would essentially still be available through reports and dashboards presuming the user has report/dashboard folder access.

share|improve this answer
Anybody who's API enabled can of course use the API to update these records at will, and anybody who's sufficiently crafty to know salesforce's URL structure will be able to get to the data anyways. The level of security afforded here is by no means air tight, but it would work for users you trust not to be "bad". – ca_peterson Oct 19 '12 at 22:03
yeah, I have already done this, my question was about whether there was any easier way of doing this by having the flow run as a more privileged user. Thanks guys! – akarnid Oct 22 '12 at 8:30
Definitely a bad pattern, and a source of a security leak that will reveal in a most unexpected moment. @Eric's suggestion is the correct way to go. – endrju Nov 18 '15 at 19:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.