I'm creating a package that allows Salesforce API access via a connected app. It works great in my demo org, but our customer does not want it to have access to any data other than contacts and a new custom object we are creating. We too would prefer not to have access to anything else, just to avoid any liability.

This customer can do this by creating a custom user to be used only for this app and applying the restrictive permissions. However, it would be nice to be able to limit this with the package itself, rather than requiring manual setup of a user.

Is there any way to automatically restrict what a package has access to or does the installing admin have to handle that via user permissions?

1 Answer 1


Believe me it is best to leave it to customer to set the required permission, that way they will be more satisfied. What you can do best is to add a permission set (Or permission sets according to different users like community, admin etc) with all the permissions of your own custom objects and their tabs. This way when customer will configure the profile they can simply add this permission set to provide the permission of packaged custom components.

Point here need to understand is that you can not provide permission of standard objects with your packaged permission set, this step requires to be done only after package installation by customer itself.

Other guideline which you can follow is to always use with sharing keyword in your classes to make sure you don't accidentally access records which should not be accessed.

Doing a security review of your application will also help you in figuring out the actions required to combat security vulnerabilities in your application.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .