I have a multi-level approval process which locks the record from editing when it is initially submitted and locks the record as a final approval action (except for current approver and sys admin). We have a visual force page to create the cases.
When I log in as a test user who has no association with the created record which is middle of an approval process, I was unable to edit the record in standard/layout view as expected. However, when I open the record in visual force page, I was able to edit the record even though I'm not the current approver or an admin. He doesn't have modify all permission either. I don't get the 'record is locked' message, it just saves with the changes.
How do I fix it? Wouldn’t the vf page respect approval process locked action.