29

I was trying to prepare a consolidated (kind of laundry) list of different types of execution and if those are executed in System mode or User mode.

Help me to validate this and mention if I have missed.

  • Trigger - User
  • Validation Rule - System
  • Auto Response Rule - System
  • Assignment Rule - System
  • Workflow Rule - System
  • Escalation Rule - System
  • All Types of calculation behind formula, Rollup Summary - System
  • Process Builder - System
  • Visual Workflow or flow - User
    • if flow is called from Process Builder - System
  • Approval Process - System
  • Publisher Action - System
  • InvocableMethod
    • if this is called from flow - ?
    • if this is called from Process Builder -? (does it depends on with or without sharing is specified on that Class)
    • if this is called from REST API - ?
  • Custom Button - System
  • Test method with System.runAs() - User
  • Test method without System.runAs() - System
  • Visualforce Page (StandardController) - User
  • Visualforce Page (StandardController with extension) - User
  • Visualforce Page (Custom Controller)
    • depends on with or without sharing of the controller
  • Visualforce Component - depends on Visualforce page where it is used
  • Macros - System
  • Annonymous Apex (running from Developer Console) - User
  • Email Service - User
  • All types of Jobs - System
  • Apex Webservices - depends on with sharing (no field-level permissions either way)
8
  • 1
    Anonymous Apex - user (with field-level permissions)
    – martin
    Commented Apr 28, 2017 at 5:16
  • 1
    Email Service - user
    – martin
    Commented Apr 28, 2017 at 5:18
  • Correct you are...you add more if you want. Commented Apr 28, 2017 at 5:19
  • 1
    Apex webservices - depends on with sharing (no field-level permissions either way)
    – martin
    Commented Apr 28, 2017 at 5:22
  • 1
    It would probably have been better to create a wiki answer. You've got a lot of the answer in your question which is confusing.
    – Adrian Larson
    Commented Apr 28, 2017 at 10:06

3 Answers 3

44

Definition

User Mode - Profile level permissions, field-level security, and sharing rules of the current user are enforced.

System Mode - Object permissions, field-level security, sharing rules aren't applied for the current user.

This is the consolidated list of execution and mode of execution:

  • Trigger - System
  • Validation Rule - System
  • Auto Response Rule - System
  • Assignment Rule - System
  • Workflow Rule - System
  • Escalation Rule - System
  • All Types of calculation behind formula, Rollup Summary - System
  • Process Builder - System
  • Visual Workflow or flow - User
    • if flow is called from Process Builder - System
    • if flow is called from Workflow - System
    • if flow is called from Apex - (depends on with or w/o sharing of apex class)
    • if flow is called from Custom Button - System
    • if flow is embed in Visualforce - Depends on VFP context
    • if flow is called from REST API - System
  • Approval Process - System
  • Publisher Action - System
  • InvocableMethod
    • if this is called from flow - User
    • if this is called from Process Builder (does it depends on with or without sharing is specified on that Class) - System
    • if this is called from REST API - (depends on with or w/o sharing of the class)
  • Custom Button - System
  • Test method with System.runAs() - User
  • Test method without System.runAs() - System
  • Visualforce Page (StandardController) - User
  • Visualforce Page (StandardController with extension) - System
  • Visualforce Page (Custom Controller)
    • depends on with or without sharing of the controller
  • Visualforce Component - depends on Visualforce page where it is used
  • Macros - System
  • Annonymous Apex - User
  • Chatter in Apex - User
  • Email Service - User
  • All types of Jobs - System
  • Apex Webservices (SOAP API and REST API) - System (Consequently, the current user's credentials are not used, and any user who has access to these methods can use their full power, regardless of permissions, field-level security, or sharing rules.)
3
  • If I try to update/insert an object from an Apex class with sharing rules which is being called by a trigger, then will it work in System mode or in User mode? Commented Jun 27, 2019 at 19:03
  • The mode is always decided by the running class and not the initiator class. So in you case it will run in user mode with sharing checks. But FLS and object access you have to determine separately. Commented Jul 14, 2021 at 1:28
  • Record triggered flows run as System, without sharing. help.salesforce.com/s/… Commented May 17, 2022 at 21:11
5

@InvocableMethod runs in System Mode. Because Process Builder runs in the system mode so the object and field level permissions both will be ignored for the user who triggers the Process.

So the question is:

  1. If this is called from flow? - Yes

  2. If this is called from Process Builder (does it depends on with or without sharing is specified on that Class) -? No, since it runs in System mode.

  3. if this is called from REST API? - Yes, this can be called from REST API. Refer this cant-invoke-invocablemethod-via-the-rest-api

0

If something is run in User Mode/Context it does not specifying that record level security is enforced. In fact most of the times by default it is not(anynomous apex is an exception here), and "with sharing" keywords are the only way to enforce sharing security if the current executing context is a User Context.

The same thing is for OLS/FLS security. In fact most of the times it should be enforced in code by programmers for the current User (that's why fflib is such a helpful tool there)

In addition Anynomous Apex, OLS and FLS are only enforced to code written directly in execute anynomous apex window. Also Triggers are run in User not System context, that's why we can enforce record level sharings.

As I can see, every execution context is quite a corner case and should be approched differently. Based on book Salesforce Lightning Platform Enterprise Architecture by Andrew Fawcett.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .