I am trying to validate the OWD for an object that is Public/Read Write without Read permission at the object level for a specific profile user. To validate the results I created a new profile by cloning the sys admin profile without read access for that object and created a permission set with 'view of Data' system permissions.
By granting the 'View All Data' it enables the Developer Console permission.
To validate the above-said scenario,
- Assigned the permission set and cloned 'sys admin' profile to a user.
- created an apex class with 'with sharing' to query the object.
- Executed the apex class by login as a new user in the dev console.
The question is, the query is returning all the records even if the user doesn't have read access to the object. Is it becuase of the OWD is 'public/read write' or the system permission 'View All Data' is granting access to all the objects in the org?