Been running into this issue for a while and would love some assistance. More than anything, I think this is a question about how to work around permissions. I hope this is the right place to ask this question: I tried asking on the SF Developer forums but haven't received a response.
We're using the Five9 call software plugin that syncs to Salesforce based on adding/removing campaign members. Based on certain lead criteria that a basic user sets, a flow is automatically launched that adds or removes the lead to/from a campaign. This works for administrator accounts: e.g., if I (with full system permissions) activate the flow that adds or removes a lead to/from a campaign, Salesforce will use my account to call an updater class (which is a public class, but importantly not global) from the installed/managed package that the call software provides.
This gets tricky when we involve users that do not have full system permissions. If a basic marketing user adds/removes a campaign member (through the automated flow), the Apex class will not show up as having been initiated on the Apex Jobs list, and the external list synchronization does not occur. This leads me to believe that these users aren't allowed to call the class in question.
What I've done:
Basically, I've gone through the permission sets and tried to add as many Apex related permissions as possible, including "Author Apex," etc. I've looked through all the online documentation I can find for what permissions would be needed, but I haven't been able to find a set of permissions that works short of giving the basic users almost full-administrator permissions, which for a number of reasons we don't want to do.
How do I make sure this Apex class is executed regardless of permissions of the user adding/removing the campaign member? Do I need to write a Global Without Sharing trigger class to add/remove campaign members every time certain record criteria are met? Would this run into the same problem?