Types of execution - System mode or User Mode?

Question

I was trying to prepare a consolidated (kind of laundry) list of different types of execution and if those are executed in System mode or User mode.

Help me to validate this and mention if I have missed.

• Trigger - User
• Validation Rule - System
• Auto Response Rule - System
• Assignment Rule - System
• Workflow Rule - System
• Escalation Rule - System
• All Types of calculation behind formula, Rollup Summary - System
• Process Builder - System
• Visual Workflow or flow - User
  • if flow is called from Process Builder - System
• Approval Process - System
• Publisher Action - System
• InvocableMethod
  • if this is called from flow - ?
  • if this is called from Process Builder -? (does it depends on with or without sharing is specified on that Class)
  • if this is called from REST API - ?
• Custom Button - System
• Test method with System.runAs() - User
• Test method without System.runAs() - System
• Visualforce Page (StandardController) - User
• Visualforce Page (StandardController with extension) - User
• Visualforce Page (Custom Controller)
  • depends on with or without sharing of the controller
• Visualforce Component - depends on Visualforce page where it is used
• Macros - System
• Annonymous Apex (running from Developer Console) - User
• Email Service - User
• All types of Jobs - System
• Apex Webservices - depends on with sharing (no field-level permissions either way)

Answer 1

Definition

User Mode - Profile level permissions, field-level security, and sharing rules of the current user are enforced.

System Mode - Object permissions, field-level security, sharing rules aren't applied for the current user.

This is the consolidated list of execution and mode of execution:

• Trigger - System
• Validation Rule - System
• Auto Response Rule - System
• Assignment Rule - System
• Workflow Rule - System
• Escalation Rule - System
• All Types of calculation behind formula, Rollup Summary - System
• Process Builder - System
• Visual Workflow or flow - User
  • if flow is called from Process Builder - System
  • if flow is called from Workflow - System
  • if flow is called from Apex - (depends on with or w/o sharing of apex class)
  • if flow is called from Custom Button - System
  • if flow is embed in Visualforce - Depends on VFP context
  • if flow is called from REST API - System
• Approval Process - System
• Publisher Action - System
• InvocableMethod
  • if this is called from flow - User
  • if this is called from Process Builder (does it depends on with or without sharing is specified on that Class) - System
  • if this is called from REST API - (depends on with or w/o sharing of the class)
• Custom Button - System
• Test method with System.runAs() - User
• Test method without System.runAs() - System
• Visualforce Page (StandardController) - User
• Visualforce Page (StandardController with extension) - System
• Visualforce Page (Custom Controller)
  • depends on with or without sharing of the controller
• Visualforce Component - depends on Visualforce page where it is used
• Macros - System
• Annonymous Apex - User
• Chatter in Apex - User
• Email Service - User
• All types of Jobs - System
• Apex Webservices (SOAP API and REST API) - System (Consequently, the current user's credentials are not used, and any user who has access to these methods can use their full power, regardless of permissions, field-level security, or sharing rules.)

Answer 2

@InvocableMethod runs in System Mode. Because Process Builder runs in the system mode so the object and field level permissions both will be ignored for the user who triggers the Process.

So the question is:

1. If this is called from flow? - Yes

2. If this is called from Process Builder (does it depends on with or without sharing is specified on that Class) -? No, since it runs in System mode.

3. if this is called from REST API? - Yes, this can be called from REST API. Refer this cant-invoke-invocablemethod-via-the-rest-api

Answer 3

If something is run in User Mode/Context it does not specifying that record level security is enforced. In fact most of the times by default it is not(anynomous apex is an exception here), and "with sharing" keywords are the only way to enforce sharing security if the current executing context is a User Context.

The same thing is for OLS/FLS security. In fact most of the times it should be enforced in code by programmers for the current User (that's why fflib is such a helpful tool there)

In addition Anynomous Apex, OLS and FLS are only enforced to code written directly in execute anynomous apex window. Also Triggers are run in User not System context, that's why we can enforce record level sharings.

As I can see, every execution context is quite a corner case and should be approched differently. Based on book Salesforce Lightning Platform Enterprise Architecture by Andrew Fawcett.