Ideally, on an asset record if the user forgets to specify an account then the following standard validation message should come up -

Every asset needs an account, a contact, or both.: Account ID, Contact ID

In few scenarios instead of the above validation being fired the users are facing the following mysterious error -

insufficient access rights on cross-reference id

I can establish that this error comes for specific products. But it is very difficult to establish in exactly which cases the cross-reference id error is popping. This happens for inactive products but not all the inactive products.

The debug log doesn't record the cross-reference id error, following are the last soql operations.

15:11:04.0 (80093061)|VALIDATION_PASS
15:11:04.0 (80126456)|CODE_UNIT_FINISHED|Validation:Asset:new
15:11:04.0 (92563768)|CODE_UNIT_FINISHED|TRIGGERS
15:11:04.0 (92577631)|EXECUTION_FINISHED
15:11:04.109 (109117256)|CUMULATIVE_PROFILING_BEGIN
15:11:04.109 (109117256)|CUMULATIVE_PROFILING|SOQL operations|
Class.Asset_TriggerHandler.setModelSerialOnAsset: line 123, column 1: [SELECT Id, Product2.Name, SerialNumber, Account.Name, ModelSerial__c
                        FROM Asset
                        WHERE ModelSerial__c IN :setOfModelSerialComb
                        AND Id NOT IN :setOfAssetIds]: executed 3 times in 5 ms
Class.Asset_TriggerHandler.setModelSerialOnAsset: line 106, column 1: [SELECT Id, Name
                        FROM Product2
                        WHERE Id IN :mapOfProdIdAndName.keySet()]: executed 5 times in 3 ms
Class.Asset_TriggerHandler.setProductOnAsset: line 57, column 1: [SELECT Id, Name
                        FROM Product2
                        WHERE Name IN :mapOfProdExIdAndProdId.keySet()
                        AND Consumer_Service_Model__c = true]: executed 3 times in 3 ms

15:11:04.109 (109117256)|CUMULATIVE_PROFILING|No profiling information for SOSL operations
15:11:04.109 (109117256)|CUMULATIVE_PROFILING|No profiling information for DML operations
15:11:04.109 (109117256)|CUMULATIVE_PROFILING|method invocations|

I'm unable to trace the reason as debug logs are not recording this error. Why exactly this error comes up? Is this related with price book or visibility of products?

  • 1
    This is a notoriously tricky-to-debug error that often has to do with sharing and visibility settings. Is your trigger handler class declared with sharing or without sharing?
    – David Reed
    Commented Jan 11, 2018 at 20:37
  • None of the keywords have been defined on the asset trigger handler
    – Jarvis
    Commented Jan 11, 2018 at 20:42
  • What's the Organization-Wide Default for these objects? Is the trigger handler called by anything other than the trigger itself? Can you reproduce the error if you declare the class without sharing?
    – David Reed
    Commented Jan 11, 2018 at 20:48
  • The OWD for Asset object is Controlled by Parent
    – Jarvis
    Commented Jan 11, 2018 at 20:50
  • Another challenge is I can't reduce the same error in pre-prod environment.
    – Jarvis
    Commented Jan 11, 2018 at 20:56

1 Answer 1


This error is very case-specific and tricky to debug, because it is usually produced due to the unique combination of your overall sharing settings, the specific user making changes, their profile (in particular, whether or not they have View All Data or Modify All Data), the ownership of the record and its parent/lookup relationships, and whether or not all of the Apex involved is declared with sharing or without sharing.

In most cases, the system administrator will be unable to produce the error because the system administrator profile has Modify All Data, which will typically suppress the sharing-related error.

Basically, the error is produced when code running in the user's context with sharing rules active and the user doesn't have permission to view either the edited record itself or, making it much trickier, one of the records to which it's linked. In your situation, I suspect this is occurring because the user is making a change to an Asset whose Account, Contact, or Product2 they do not have permission to see, and some portion of your Apex is running with sharing enabled.

One remediation strategy, if and only if it's applicable in your unique security and sharing architecture, is to explicitly declare your Apex without sharing. (It's best practice to declare sharing model in Apex one way or the other anyway).

  • But I have heard that 'without sharing' is not recommended and it doesn't go through the Salesforce reviews as well.
    – Jarvis
    Commented Jan 22, 2018 at 11:17
  • 2
    Are you building an application for the AppExchange? If you need to worry about the AppExchange security review, talk to your architect about what is most appropriate in the context. If not, there is no review. without sharing is a tool. If a piece of code needs to see/modify records the running user doesn't have access to due to OWD/sharing rules, it needs to be without sharing.
    – David Reed
    Commented Jan 22, 2018 at 12:01
  • I'll definitely try that but I'm unable to replicate the issue in Pre-Prod with the same product, same OWD and same trigger handler for the same user
    – Jarvis
    Commented Jan 22, 2018 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .