CRUD & FLS on Managed Package Objects

Question

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to manage what user types are allowed to do.

We know that CRUD/FLS checks are important on subscriber objects because we don't otherwise know their security rules. Are CRUD/FLS checks still important on the packaged objects too? Ultimately we're only going to allow our code to run for users whose Permission Set allows the requested operation.

Answer 1

Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can restrict or technically impose on them .So the CRUD/FLS checks are still important on the packaged objects and your apex code should impose CRUD/FLS checks .