I have delete button on the visualforce page. If particular record status moved out of 'Draft' then the record should not be deleted. If user clicks on delete button with the status value 'Open', it should not allow any user to delete the record.
I've already done this in sandbox and pushed to prod. After some days, some users are able to delete the record eventhough the status of the record is moved out of 'Draft'. But if I try to reproduce the problem in sandbox by logging in as a user who deleted the record in production is not able to delete the record.
Then I checked all the security informations(user, profile, permission set, apex code) everything is same as that of in production.
So my question is,
Then how would the user was able to delete the record in Production?.
Also, Is there any way to block any users to delete the record(bypassing everything)?.