Critical Update: Require User Access to Apex Classes Invoked by Flow when running user = Automated Process

Question

Given

• Critical Update Require User Access to Apex Classes Invoked by Flow is activated

• Apex trigger that subscribes to a Platform Event

• Trigger logic does DML
• Process Builder executes and makes Invocable Apex call

When

• Running user = Automated Process (as of V46, by definition)

Then

Flow blows up with Require User Access to Apex Classes Invoked by Flow

But there's no way to assign the Automated Process user's Profile to any Apex class nor can you assign a Permission Set to Automated Process user

e.g.

insert new PermissionSetAssignment(
  AssigneeId = [select id from User where name = 'Automated Process'][0].Id,
  PermissionSetId = [select id from PermissionSet 
         where name = 'Classes_Automated_Process_User_Needs'][0].Id);


System.DmlException: Insert failed. First exception on row 0; first error: 
FIELD_INTEGRITY_EXCEPTION, Can't assign permission set to this user,
                           user license doesn't match: []

Is there another way to assign Automated Process user to a Permission Set or give it access to this invocable apex class?

Critical Update auto-activates 2019-11-30

Answer 1

The real answer was provided by Matt over on Salesforce Success

1. Get the ProfileId of Automated Process User using Dev Console

    SELECT ProfileId from User WHERE alias = 'autoproc'
   

2. Coerce the URL that edits Apex class access for a Profile

    /_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id=theAutomatedProcessProfileId
   

and you'll get the familiar dialog to assign Apex classes to a Profile.

Answer 2

After a call to SFDC Support, the answer seems to be:

"Call SFDC Support to enable Automated Process user access to invocable classes before enabling this Critical Update."

Clearly unsatisfactory. Let's hope Winter 20 has a solution.

UPDATE: If you do call Support, they will tell you that you can self-serve by entering the Automated Process's ProfileId 00e36000000oZf3AAE into the URL - but you'll get Insufficient Privileges if you do that whereas if Support logs in as you, they do not get an error and can see the profile.