Can you help me to see whether the below is actually possible in Apex?

We're setting up Sharing Settings in our development Org and I want to have a quick way of knowing whether what we've built is correct (in stead of needing to go over all the test users, impersonating and validating), as well as to have a good way of knowing that the changes we make don't break anything that worked previously.

When I create an account of type Partner and login as a user with a Sales role, I'm able to see the Account record (and only those records). However, the below Apex test fails.

Sharing Setting example: Account OWDs are set to Private. There is a Sharing Setting (criteria based) that shares Accounts when Type = 'Prospect' to Sales roles.

Apex Test Class

private with sharing class Test_RoleAccess {
    private static void testSetup() {

        // generate Sales User.
        User testUser =  Test_RoleAccess.generateUser('Sales'));
        insert testUser;
        User runAsUser = Test_RoleAccess.generateUser('CEO'));
        // using runAs() to avoid Mixed DML error. Inserting Accounts in the 
        // actual testMethod does not change anything in behavior. 
        System.runAs(runAsUser) {
            List<Account> testAccounts = new List<Account>{
                // shared with sales user using criteria based sharing rule
                new Account(Name = 'Sales Account', Type = 'Partner'),
                // not shared with sales user
                new Account(Name = 'Service Account', Type = 'Installation Partner')
            insert testAccounts;

    private static void testAccountAccess() {

        // this assert passes, so Accounts are inserted
        System.assertEquals(2, [SELECT Id FROM Account].size());

        System.runAs(getUser('Sales')) {
            List<Account> visibleAccounts = [SELECT Id FROM Account];
            // this test fails: Sales Visibility Error: Expected: 1, Actual: 0
            System.assertEquals(1, visibleAccounts.size(), 'Sales Visibility Error');

    private static User getUser(String userType) {
        // gets the user based on the type
    private static User generateUser(String roleName) {
        // generates unique users with the role specified

I feel like the above test should succeed, but it doesn't. Only reason I can think of is that the calculation of the sharing is seperate from the account insert transaction and is only finished after my test method has run. Any other takes here?
  • What happens if you explicitly set the OwnerId for the new accounts when you create them? I am thinking the owner is defaulting to the user who runs the test, not the "Sales" test user.
    – Phil W
    Aug 31, 2022 at 13:29
  • Woops, in simpling down the logic I made a mistake. The records are not created by a sales user, but by a user with role CEO (higher up in the hierarchy). Updated the example.
    – xouns
    Aug 31, 2022 at 13:49

1 Answer 1


According to the below help article, Criteria-based sharing rules cannot be tested via Apex: https://help.salesforce.com/s/articleView?id=sf.security_sharing_rule_types.htm&type=5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .