Trying to develop some test classes around security and noticed this issue and was curious if anyone else has found this, is it a bug, and have you been able to work around it within the system.runAs in the test methods:


In test methods when getting the userrecordaccess.maxaccesslevel for ANY record to which the running user only has READ access, the MAXACCESSLEVEL ALWAYS returs 'Transfer'.

This is NOT the case though as the user should only have read access.

Steps to recreate:

  1. Create a record to which a user only has READ access.
  2. Replace the IDs in the below pseudo code with the user id and record id as appropriate
  3. You will see that calling the UserRecordAccess using the userid and recorded outside of the runAs produces the 'Read' result
  4. Inside the runAs the result is 'Transfer' and the assertion fails (and yes actually querying the userrecordaccess produces the same 'Transfer' result)

private static void test_one(){

    User popAdmin = [Select ID From User Where ID = '005F0000003GluW'];

        UserRecordAccess ura = [Select RecordID, MaxAccessLevel From UserRecordAccess Where UserID = '005F0000003GluW' AND RecordID = '003L000000Lb1cF'];


        contact c = [Select UserRecordAccess.MaxAccessLevel From Contact Where ID = '003L000000Lb1cF'];



I fail to see why the MAXACCESSLEVEL is being returned as 'Transfer' using the new MaxAccessLevel in the record Query ran inside the runAs block. I am curious to know if this is a bug or is running as expected

1 Answer 1


Here is the Response from Salesforce Support. I did not realize this being the case...

Correct way to query - SELECT MaxAccessLevel,RecordId FROM UserRecordAccess WHERE RecordId = '003D000000PUnOo' AND UserId = '005D0000001mYlT'

AND NOT SELECT UserRecordAccess.MaxAccessLevel FROM Contact Where ID = '003D000000PUnOo' -> Here you are actually asking the system that whats the max access level on this record and it's saying 'Transfer' which is correct. It doesn't mean that "transfer' is the max access level for the current user. It means "transfer" is the max access level for that contact record.

If you want to find the max level access for that user on that contact record you need to query- SELECT MaxAccessLevel, RecordId FROM UserRecordAccess WHERE RecordId = '003D000000PUnOo' AND UserId = '005D0000001mYlT' -> this says Read is the maximum access level for the given user.


Here is a link to the bug that salesforce has initiated. If this is happening to you as well click the link and then click the "This Affects Me" button


  • I do not agree with this response from Salesforce as the documentation at salesforce.com/us/developer/docs/api/Content/… indicates that this feature should "Use this object to query a user’s access to records" and the API 30 documentation is under that section. I fail to see the use case to return Transfer because at least one user in the org has the ability to transfer (Or at least edit). Of course they do, they are the owner. With that login it would never return read
    – Eric
    May 24, 2014 at 0:25
  • Ok, after my comments above they reopened the case and escalated to R&D. Seems I was correct in the answer given to me was an attempt to explain the result returned rather than actually trying to see if what was returned was the desired behavior
    – Eric
    May 30, 2014 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .