I'm still a bit unsure which Apex classes I have to enable in a Permission set.

  1. I guess I don't need to enable Test classes
  2. I definitely need to enable Controller and Controller extensions for enables VF pages
  3. But do I also need to enable all the classes that are indirectly called by those classes
  4. Does the with sharing tell me anything about whether or not to enable a class?
  5. Does it matter wether the class is static or not?
  6. Do I need to enable abstract super classes that are indirectly used?
  7. What about Trigger Handler classes (= classes that hold the triggers code)?

The same in a way applies to Objects and their fields:

  1. If I use a purely technical SObject that is created and deleted by trigger code only. Do I need to enable in the users permission set?

2 Answers 2


that's a lot of questions!

1) No, you don't need to enable test class access permissions for users

2) Controllers and their extensions do need to be assigned by permissions (https://help.salesforce.com/HTViewHelpDoc?id=users_profiles_apex_access.htm&language=en_US&release=180.7)

3) No, all classes required by a class to which a user has permission can then be accessed by the user.. (https://help.salesforce.com/apex/HTViewHelpDoc?id=pages_page_level_security.htm&language=en_US)

4) "With sharing" affects only the record access (and SOQL) on a controller, "with sharing" means the class runs with the record access levels of the calling user, not the system. (http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_classes_keywords_sharing.htm) - it bears no relation to whether a user should have access to an Apex class.

5) No, Static has no affect on permissions, however, a lot of static classes/methods end up being called from other classes (in my experience) and so, with point 3 above, they will often find themselves "accessible" due to the cascading effect.

6) Nope, see 2 above!

7) Trigger events are executed at a system level every time they are required, so users do not need permissions for their code, or their associated utility classes

1a) Again, no because as per 7, the Trigger is executed by the system and so will have all the permissions needed to complete DML etc. (note the user may well not have access to the record that has been created though.)

  • 3
    A great response, very detailed, regarding point 3, if the classes are packaged and have global visibility (e.g. an Apex API provided by the package suppler) these will need to be added. Feb 11, 2014 at 10:41
  • Thank you Andrew, and a very good supplementary point! Cheers. Feb 11, 2014 at 10:42
  • @SimonLawrence - Do we need to give permission separately to all the objects and the fields that the main controller and related classes use ?
    – SFDCRookie
    Aug 31, 2016 at 10:30
  • @SFDCRookie - you should not need to no, once the "data", or processing is into the controller and it's related classes they should have access to the objects and fields as per the system (note: accessing fields and objects in this kind of way in an app-exchange submission will probably get you a fail) Sep 1, 2016 at 10:02
  • @SimonLawrence- Currently I'm facing Insufficient Privilege error while I'm trying to save a record selecting a particular value . the values are not getting restricted through any record type . What could possibly be the reason ?
    – SFDCRookie
    Sep 1, 2016 at 12:35

I have experienced odd behaviours when not manually assigning apex class access which operate on Opportunity cloning behaviour. We use the standard Opportunity Clone button, which enables to clone with or without products.

As long as I do not manually assign apex class access to a profile without "author apex" permission, cloning an opportunity "without products" will NOT execute the apex class called by the trigger behind it.

So keep in mind that the Salesforce user interface may make use of some kind of web services, for which you need to enable apex class access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .