I'm receiving the following error:

TR09_MasterServiceAgreement: execution of AfterInsert caused by: System.DmlException: Delete failed. First exception on row 0 with id 02c1800002Lir2PAAR; first error: INSUFFICIENT_ACCESS_OR_READONLY, insufficient access rights on object id:

When deleting a share object: Master_Service_Agreement__Share.

The user is the owner of the record and has delete permission on the object Master_Service_Agreement__c. Maybe it's also worth noticing that I'm using a custom row cause: Schema.Master_Service_Agreement__Share.RowCause.TeamMember__c and that this deletion is called within a trigger.

What are the possible explanations for this error? I really can't figure it out why. Thanks! Here's my code:

//after update trigger
trigger TR08_Account on Account (after insert, after update, before insert, before update, before delete) {
    if(Trigger.isAfter && Trigger.isUpdate) {
        TR08_Account_Service service = new TR08_Account_Service((List<Account>) Trigger.new, (Map<Id, Account>) Trigger.oldMap);

//getst msa related to account, accountIds is a list of account id from trigger.new
private void getMsa()
    msaList = [SELECT Id, OwnerId, Account__c, Account__r.OwnerId FROM Master_Service_Agreement__c WHERE Account__c IN :accountIds];
    msaIdList = new List<Id>();

    for(Master_Service_Agreement__c msa : msaList) 

//function that causes the error
private void deleteOldMsaSharing()
    List<Master_Service_Agreement__Share> oldMsaSharing = [SELECT Id FROM Master_Service_Agreement__Share WHERE ParentId IN :msaIdList AND RowCause = :Schema.Master_Service_Agreement__Share.RowCause.TeamMember__c AND UserOrGroupId != :UserInfo.getUserId()];

    delete oldMsaSharing;

EDIT: for future readers, I solved the problem by giving the user the "Modify all data" permission on the object Master_Service_Agreement__c

  • 1
    Calling that deletion from a trigger context? – Carlos Naranjo Dec 7 '18 at 12:36
  • 2
    Can you please post here the trigger you are using? This error looks like fires in connection with and After Insert DMML operation. You need to check the triggers that are doing that. – Carlos Naranjo Dec 7 '18 at 16:26
  • 1
    I agree with Carlos; I think we can help solve this problem without using Modify All Data if you can share a little more detail. These kinds of issues are often a bit convoluted but can be solved. – David Reed Dec 10 '18 at 14:24
  • 1
    How is msaIdList generated? In what context is deleteOldMsaSharing() called, and in particular, what is the sharing declaration of its enclosing class? – David Reed Dec 10 '18 at 16:46
  • So the contex is the after update trigger, I added the piece of code that gets msaIdList and the class is declared with "without sharing" – JoulinRouge Dec 11 '18 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.