1

We have a bunch of case assignment rules in our system. Most Cases are created via an integration with an external web form, but some Cases are manually entered by Users in Salesforce (these are the ones we're having issues with). The Case OWD is Private, with access being granted via Owner-Based Sharing Rules & Role Hierarchy.

Some users are getting this error when they try to create a Case:

"We hit a snag. You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary"

I've checked the object and field permissions and everything is correct. Furthermore, the error doesn't appear every time a User creates a Case, which indicates that this is related to record-access rather than object/field access. The error only seems to appear under these 2 scenarios:

  1. The Case being created will be assigned to a Queue which the creator is not a member of
  2. The Case being created will be assigned to the default Case Owner (a system admin at the top of the role hierarchy, so the User won't have permission to see this Case)

Based on these 2 scenarios, it seems like a User cannot create a Case if the assignment rules that fire afterwards are going to cause the creator to lose access to it entirely. Is that expected??

I was under the impression that the Case Assignment Rules run AFTER the User's permissions are validated for creating the record, therefore it is always feasible that a User can create a Case regardless of whether they can view it or not after the assignment rules run. So I guess a more general question is, when does record access get checked in the order of execution? The salesforce documentation is vague about this.

Lastly, if this is a known limitation in how permissions work with Case Assignment rules, would a suitable solution be to simply write a BeforeInsert trigger to set the Owner = a system admin User, so that the Assignment Rules can run without hitting any permission errors?

4
  • 1
    assignment rules run in the context of the running user; for those cases manually entered by users; have the assignment rules run in an async transaction
    – cropredy
    Commented Mar 13, 2023 at 16:33
  • @cropredy thanks! Something interesting has just come up though... The Case records ARE still being created even though Users are getting this "We hit a snag" error on the create screen! This has resulted in tons of duplication of cases. I've never seen Salesforce throw a permissions error on the create screen but still create the Case record in the background. Any idea what's happening there?
    – JustinF
    Commented Mar 16, 2023 at 5:29
  • so, I have seen the error (for example, when the email address is valid on the form but not valid per SFDC email rules) -- but then the Case isn't created. Are the users also uploading attachments? If so, the Case will be created but the attachment upload fails because it runs in a separate transaction (and can fail due to losing access to the parent Case object)
    – cropredy
    Commented Mar 16, 2023 at 17:12
  • @cropredy no, users aren't uploading attachments (and no related records are being created by automation)
    – JustinF
    Commented Mar 17, 2023 at 10:07

0

You must log in to answer this question.