I have a basic class with no sharing keyword as I want it to inherit the permissions from callee. What would the context be?

I assume it should run as system (aka without sharing) context, but what I am seeing is opposite. I am getting security exceptions that I shouldn't and fixes by upgrading the class to without sharing.

Is this expected behaviour?

  • Whatever you're seeing, it seems likely WAD.
    – Adrian Larson
    Commented Feb 27, 2017 at 1:59

2 Answers 2


Invocable Actions are called through the REST API. In fact, you can use them outside of flows, such as just calling them in JavaScript, or in Salesforce1, etc. That said, it makes sense that security would be enabled by default, since it can be accessed from any context. In fact, the Invocable Action can't even be called unless the user has profile or permission set access to the class. I don't think you'll find any documentation on it, though.

  • Do we know that Invocable Actions are accessed through a callout to the REST api when used as part of a process builder process?
    – martin
    Commented Feb 27, 2017 at 3:01
  • So does this mean invocable methods will always run in user context??
    – Samir
    Commented Feb 27, 2017 at 3:03
  • @martin I don't think it's literally called via REST call (because you can't callout after DML), but probably acts the same regardless of context in order to maintain the principle of least astonishment.
    – sfdcfox
    Commented Feb 27, 2017 at 3:17
  • @Samir It appears to do so by default, unless you use without sharing. Again, I don't see it in the docs, but the fact it was designed as a REST API tool seems to suggest it should run with sharing.
    – sfdcfox
    Commented Feb 27, 2017 at 3:19
  • 1
    @Samir It should still run as "with sharing." I'm pretty sure the only time it doesn't is when you explicitly mark the class as "without sharing."
    – sfdcfox
    Commented Feb 27, 2017 at 3:29

I've confirmed that invocable methods inside classes with inherited sharing will run with sharing when called from Process Builder. Which is unfortunate because Process Builder is supposed to essentially run without sharing. Maybe this was an oversight?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .