Been running into this issue for a while and would love some assistance. More than anything, I think this is a question about how to work around permissions. I hope this is the right place to ask this question: I tried asking on the SF Developer forums but haven't received a response.


We're using the Five9 call software plugin that syncs to Salesforce based on adding/removing campaign members. Based on certain lead criteria that a basic user sets, a flow is automatically launched that adds or removes the lead to/from a campaign. This works for administrator accounts: e.g., if I (with full system permissions) activate the flow that adds or removes a lead to/from a campaign, Salesforce will use my account to call an updater class (which is a public class, but importantly not global) from the installed/managed package that the call software provides.

This gets tricky when we involve users that do not have full system permissions. If a basic marketing user adds/removes a campaign member (through the automated flow), the Apex class will not show up as having been initiated on the Apex Jobs list, and the external list synchronization does not occur. This leads me to believe that these users aren't allowed to call the class in question.

What I've done:

Basically, I've gone through the permission sets and tried to add as many Apex related permissions as possible, including "Author Apex," etc. I've looked through all the online documentation I can find for what permissions would be needed, but I haven't been able to find a set of permissions that works short of giving the basic users almost full-administrator permissions, which for a number of reasons we don't want to do.

My question:

How do I make sure this Apex class is executed regardless of permissions of the user adding/removing the campaign member? Do I need to write a Global Without Sharing trigger class to add/remove campaign members every time certain record criteria are met? Would this run into the same problem?


  • Check object and field-level security settings for the users' profiles as well - if the classes are marked with sharing, that could very well be the issue. Good job providing background and what you've tried so far - excellent for a first post. – Brian Mansfield Apr 4 '19 at 16:59
  • what is the relationship between the Flow and the Apex class? Is it an invocable apex class that in turn starts a scheduled apex job? – cropredy Apr 5 '19 at 2:28
  • Cropredy, I believe so. It's hard to find documentation from the developer. The flow adds/removes campaign members. When this is done, the call center managed package automatically "syncs" the leads/contacts to their server (where it calls from). The class that gets called in this case is a Public, Non-Global class. – James Apr 8 '19 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.