INVALID_ACCESS_LEVEL you don't have access to the Orchestration Run object

Question

I have a flow that cancels an Orchestration, it works when run as an administrative user.

When I run as a non administrative user, it produces the following error even when the flow is set in system context:

"Error Occurred: The flow tried to update these records: 0jEr0000000GnEdEAK. This error occurred: INVALID_ACCESS_LEVEL: You can't cancel this orchestration because you don't have access to the Orchestration Run object. Your Salesforce admin can help with that.. You can look up ExceptionCode values in the SOAP API Developer Guide."

On https://developer.salesforc... it says : "You can’t define a new sharing rule that provides less access than the specified org-wide default"

Doesn't make sense to me since its an enablement, since I cant grant access to the object to users directly.

Per a related recommendation of a user on SFXD I tried: Creating a Platform Event, to trigger an Async process which ran the subflow in system context.

This did not work either for non administrative users.

Answer 1

Long road to get to the conclusion:

Required Permission https://help.salesforce.com/s/articleView?id=sf.orchestrator_manage_cancel_running_orchestration.htm&type=5

Requires Salesforce License NOT Salesforce Platform.

System Context Flows/PB, Platform Events, and Async processes don't work. I tried to add the permission to the automated process user via URL hackery/dev console commands and found the automated process user's license doesn't allow the manage flow permission. https://ideas.salesforce.com/s/idea/a0B8W00000GdYhrUAF/give-the-automated-process-user-an-actual-admin-profile

In my situation, we have an org that has Salesforce Platform Licenses which caused the pain. I've reached out to our vendor who previously said we could switch (assuming this is honored, then I have my solution).

To work around the issue I switched the orchestration steps to use evaluation flows to check for completion. I then used a platform even on the orchestration event object to trigger the evaluations. Note I recorded the OrchestrationInstanceId to a field on the record in an initial auto-launched stage because users encountered permissions issues querying for it later on.