# Testing sharing with runAs, UserRecordAccess and access summaries

*Platform Sharing and Visibility Architect Study Guide · Implications of Security Model Choice · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/implications-of-security-model-choice/testing-sharing-with-runas-userrecordaccess-and-access-summaries*

How to prove a sharing model works: the insufficient-privileges walkthrough, System.runAs tests, UserRecordAccess queries, Sharing Hierarchy reasons, User Access Summary and Public Group Access Summary, restriction rule tests, and the separate checks for guest, high-volume and role-based external users.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Implications of Security Model Choice
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a set of conditions, determine how to test the sharing model.

## What the exam expects

- Lay out a test process for a security model and the order in which to check permissions and sharing layers.
- Write or review `System.runAs` tests and know what they enforce and ignore.
- Query UserRecordAccess correctly and know what it doesn't consider.
- Read Sharing Hierarchy reasons and use the User Access Summary and Public Group Access Summary to find the source of access.
- Test restriction rules, guest users, high-volume users and role-based external users with the right checks and evidence.

Key terms: **System.runAs** (test-only method that switches user context); **UserRecordAccess** (read-only object reporting a user's access to records); **Sharing Hierarchy** (record action listing who has above-default access and why); **User Access Summary** (consolidated permissions with Access Granted By); **test persona** (a user built with exactly a target user's permissions).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| runAs enforces | User's sharing rules plus object and field permissions | [Using the runAs Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_testing_tools_runas.htm) |
| runAs limits | Test methods only; ignores licence limits; counts as DML | [Using the runAs Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_testing_tools_runas.htm) |
| UserRecordAccess | Ignores restriction rules; up to 200 record IDs | [UserRecordAccess](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_userrecordaccess.htm) |
| Sharing Hierarchy | Lists access greater than the default | [Viewing Which Users Have Access](https://help.salesforce.com/s/articleView?id=platform.viewing_which_users_have_access_lex.htm&language=en_US&type=5) |
| Administrator reason | View All or Modify All permissions | [Viewing Which Users Have Access](https://help.salesforce.com/s/articleView?id=platform.viewing_which_users_have_access_lex.htm&language=en_US&type=5) |
| User Access Summary | View Setup and Configuration; Access Granted By | [View a User's Access Summary](https://help.salesforce.com/s/articleView?id=platform.users_access_summary.htm&language=en_US&type=5) |
| View All holders | See all records regardless of restriction rules | [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&language=en_US&type=5) |
| Guest record access | Only guest user sharing rules | [Guest users](https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_external_guest.htm&language=en_US&type=5) |

## Check yourself

- Why can a runAs test insert users in a sandbox with no free licences?
- Which sharing mode does a method called inside a runAs block use?
- Why might Sharing Hierarchy be missing from a record's action menu?
- Which setting lets Customer Community Plus users edit cases that name them as contact?

## Sources

- [Troubleshoot Object and Record Access Issues](https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_map.htm&language=en_US&type=5)
- [Using the runAs Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_testing_tools_runas.htm)
- [UserRecordAccess](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_userrecordaccess.htm)
- [Viewing Which Users Have Access to Your Records in Lightning Experience](https://help.salesforce.com/s/articleView?id=platform.viewing_which_users_have_access_lex.htm&language=en_US&type=5)
- [View a User's Access Summary](https://help.salesforce.com/s/articleView?id=platform.users_access_summary.htm&language=en_US&type=5)
- [Troubleshooting User Access Issues and Insufficient Privileges Errors](https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_flowchart.htm&language=en_US&type=5)
- [Additional Considerations for Troubleshooting Access Issues](https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_considerations.htm&language=en_US&type=5)
- [Restriction Rule Considerations](https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_considerations.htm&language=en_US&type=5)
- [Troubleshoot Field Access Issues](https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_field.htm&language=en_US&type=5)
- [Public and Personal Groups](https://help.salesforce.com/s/articleView?id=platform.user_groups.htm&language=en_US&type=5)
- [Troubleshoot Access Issues for Guest Users](https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_external_guest.htm&language=en_US&type=5)
- [Test Guest User Access in Your Experience Cloud Site](https://help.salesforce.com/s/articleView?id=platform.networks_guest_access_test.htm&language=en_US&type=5)
- [Troubleshoot Access Issues for High-Volume Users](https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_external_hpvu.htm&language=en_US&type=5)
- [Troubleshoot Missing Object or Record Access for Customer or Partner Users](https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_external_missing.htm&language=en_US&type=5)
- [Database Operations Run in User Mode by Default, Not System Mode](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 18 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams