We use batchable Apex and we use 2 custom objects to process a CSV with some records and then insert them or update them as Account records. So, i give permissions to the user's profile that runs this job on Account object to have read,create, and edit access on Account object. However, i don't want this user to view Accounts so in this profile i select tab hidden on Account object. Although i do not see the account tab, i still have access to accounts. For example, if i copy-paste the link of an account record like (https://MYDOMAIN.lightning.force.com/lightning/r/Account/0011l00000Z5YSGFA3/view), i have access to the record and i can modify it. What is the best way to handle such situations ?
Depending on your use case, you can probably just turn off CRUD permission for Accounts. Apex can run in "system mode", where it ignores normal security (field, object, and record security). Simply specify "without sharing" in your class' definition (e.g.
public without sharing class CsvBatch implements Database.Batchable<String>). You can still choose to enforce sharing on a case-by-case basis using UserRecordAccess, describe calls, etc.