I have a special requirement to protect a custom object from admins modifying through all channels like API, workbench, standard platform feature etc but should be able to view through all channels but update the custom object through a particular VF page only. I can't use without sharing keyword since it will let them see all records of custom object which also is violation visibility, not all admins can all records but only relevant to them. There will be sharing rule to share specific records with each admin.
- Currently I'm thinking about creating special user and use System.runas in regular apex controller to execute the code as special user solve this problem (non test mode), wondering this will work or not?
- Simple trigger preventing all DML and control that trigger through static variable to execute only when an update made from VF Page