I have a custom object B that has a master detail relationship to Account. The sharing settings on Account are set to Private. Account CRUD for sys admin and user 1 is create, edit, view, delete. The CRUD on B for the system admin is create, edit, view, delete. The CRUD for user 1 is nothing.

I have a test case that creates an Account in a @testSetup method. In the test case, the code retrieves the account and does a System.runAs(sysadmin) and creates an object of B. Then I have second System.runAs(user1) that simply tries to retrieve the object B. This should fail. In one sandbox it DOES fail. In another sandbox it does NOT fail and I cannot explain it.

public static void setupTests() {
    User u1 = TestDataFactory.createUser(USERNAME_1, ACCT_MGMR);
    User sysadmin = TestDataFactory.createUser(USERNAME_SYSADMIN, SYSTEM_ADMIN);

    Account acc = TestDataFactory.buildAccount(ACCOUNT_NAME);
    insert acc;

public static testMethod void testCRUD() {
      User u1 = [SELECT id FROM User WHERE username = :USERNAME_1];
      User sysadmin = [SELECT id FROM User WHERE username = :USERNAME_SYSADMIN];
      Account account = [SELECT id FROM Account where name = :ACCOUNT_NAME];

  MyObjectB__c objB = null;
  System.runAs(sysadmin) {
    objB = new MyObjectB__c(
      Account__c = account.Id,
      user__c = u1.id);
    insert objB;

  System.runAs(u1) {
    try {
      objB = [SELECT Id FROM MyObjectB__c WHERE Account__c =
        :account.Id AND User__c = :u1.id];
      System.assert(false, 'Should have failed.');
    } catch (QueryException dmle) {
      System.assert(true, 'Should fail here. ' + dmle.getMessage());
  • Are you sure the permissions and API versions are the same for that profile? Create your own user instead, maybe you're querying for someone who has a PermissionSet.
    – Adrian Larson
    Mar 4, 2016 at 22:33
  • Good thought. I am creating that user newly. Just edited code to show that. Thanks! Mar 4, 2016 at 22:37
  • 2
    @ChrisFellows You're not creating a new user-- you're querying for a user. Did you make sure they have the same profile in each sandbox? Permission sets? Any difference at all could cause this to happen. Also, you could try querying UserRecordAccess to verify the access level of the user according to the share table.
    – sfdcfox
    Mar 4, 2016 at 22:39
  • I updated the code to show where the user gets created in the @testSetup. Good idea on UserRecordAccess. Will try... Mar 4, 2016 at 23:59
  • @AdrianLarson - i think the issue is that Apex does not respect CRUD... Mar 7, 2016 at 19:18

1 Answer 1


Looks like the issue is that Apex does not respect CRUD.



I would have to use something to effect of:

if (!Schema.sObjectType.Contact.fields.Status__c.isUpdateable()){
  ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                             'Insufficient access to update status'));
  return null;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.