I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new user, but I still see that the object gets updated and the field is updateable. Am I missing something here?

Here is the code:

   public class sampletest {

    static User createuser(){
        String username = 'testUser';
        Profile p = [SELECT Id FROM Profile WHERE Name='Standard User'];
        User newuser = new User(Alias = username, Email='[email protected]',
                                ProfileId = p.Id,  Country='United States',
                                TimeZoneSidKey='America/Los_Angeles', UserName=username
                                + Datetime.now().hour() + Datetime.now().minute()
                                + Datetime.now().second() +'@testorg.com');
        insert newuser;
        system.debug('Creating user: ' + newuser.id);
        return newuser;

    static testmethod void method1(){
        User newuser = createUser();
            Lead newlead = new Lead(LastName='Some', Company='XYZ');
            insert newlead;

            Lead lead = [Select name from Lead Limit 1];
            String[] strfields = new String[] {'Company', 'FirstName'};  
            SobjectType objType = Lead.getSobjectType();
            Map<String, Schema.SObjectField> fields = objType.getDescribe().fields.getMap();
            system.debug('Fields: ' + fields );

            for (String strfield : strfields) {
                    system.debug('Field ' + strfield + ' is updateable');
            upsert lead;

    private static void assignObjectPermission(User u, String objectType, Boolean create, Boolean edit, Boolean remove){
        PermissionSet ps = new PermissionSet(Name = 'Enable' + objectType, Label = 'Enable ' + objectType);
        insert ps;                                  

        ObjectPermissions oPerm = new ObjectPermissions(ParentId = ps.Id,
            PermissionsRead = true,
            PermissionsCreate = create,
            PermissionsEdit = edit,
            PermissionsDelete = remove,
            SObjectType = objectType);

        insert oPerm;
        system.debug('permission: ' + oPerm);

        PermissionSetAssignment assign = new PermissionSetAssignment(AssigneeId = u.Id, PermissionSetId = ps.Id);                       
        insert assign; 
        system.debug('assign: ' + assign);

I see the following logs and upsert is successful:

20:20:46:838 USER_DEBUG [34]|DEBUG|Field FirstName is updateable
20:20:46:838 USER_DEBUG [34]|DEBUG|Field Company is updateable

1 Answer 1


"Standard User" is the profile which you have assigned to your user.

And if we check lead permission on that then enter image description here

We found that they already have create and update permission for lead. Using permission set we can't restrict user's permission we can only enhance them.

So if your permission set doesn't allow the lead reate and update still user can update it because there profile allow to do so. If you want to check this then first remove this permission from there profile and then test it.

You can read in more detail about permission set in given reference.

Permission Set Reference

  • Thanks I wasn't aware that you cannot restrict user permissions using permission sets. I changed that to a read only user and I get the expected output. However, I still see that the upsert lead went through even though it is running as the newUser. Is that expected behavior?
    – gerad26
    Commented Jan 17, 2017 at 7:06
  • @gerad26 you need to check object level permission. Commented Jan 17, 2017 at 7:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .