The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI".
And the answer is: By using the new Force.com ESAPI implementation from Github
With Spring' 20 the Security.stripInaccessible() is GA. Peterson and Ballinger rewrote this Salesforce-...
After a dance with Salesforce support they confirmed that in Salesforce there is no single document stating what is needed for that but here it is:
Sales Cloud Standard User License, Sys Admin not needed
Read Access to Leads, View All is not required
Log in to Subscriber Organization system permission (a permission set is enough for that)
The fflib selector design pattern and its query factory has been an old-fashion and cumbersome design. Say if you wrote a function selectById with only a list of Id as the parameter, and has been put into use. But then some new features need to be added, e.g. orders, limits, or even more conditions. Now you have two options, write a completely new function ...