# Apex access modes, sharing keywords and stripInaccessible

*Platform Sharing and Visibility Architect Study Guide · Permissions to Standard Objects, Custom Objects, and Fields · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/permissions-to-standard-objects-custom-objects-and-fields/apex-access-modes-sharing-keywords-and-stripinaccessible*

How Apex enforces object permissions, field-level security and sharing: sharing keywords for record access, explicit user and system access modes and the API 67.0 default change, Security.stripInaccessible and describe checks, and the framework contexts (Lightning Data Service, Visualforce controllers, Apex class access, Automated Process) that change the answer.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Permissions to Standard Objects, Custom Objects, and Fields
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a scenario, recommend the appropriate programmatic solution to ensure security settings are enforced.

## What the exam expects

- Separate the two Apex security questions: which records (sharing keywords, or user mode) and which objects and fields (access modes, stripInaccessible, describe checks).
- State the default access mode by API version and recommend explicit modes in every operation.
- Choose between failing fast (user mode) and degrading gracefully (stripInaccessible) for queries and DML.
- Prefer platform enforcement where it exists: Lightning Data Service, Visualforce standard controllers; grant Apex class access; handle Automated Process and Experience Cloud user-information gaps.

Key terms: **sharing keyword** (with, without or inherited sharing on a class; record-level only); **access mode** (user or system mode for one database operation); **user mode** (enforces the user's object permissions, field-level security and sharing); **stripInaccessible** (removes inaccessible fields from records); **Lightning Data Service** (LWC data layer on User Interface API).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default from API 67.0 | Unmarked database operations run in user mode | [Release note: User Mode by Default](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5) |
| Default at API 66.0 and earlier | System mode | [Secure Apex Classes (LWC guide)](https://developer.salesforce.com/docs/platform/lwc/guide/apex-security.html) |
| WITH SECURITY_ENFORCED | Removed as of API version 67.0 | [Release note: User Mode by Default](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5) |
| Sharing keywords | Record-level only; no object or field security | [Secure Apex Classes (LWC guide)](https://developer.salesforce.com/docs/platform/lwc/guide/apex-security.html) |
| User mode and sharing | Always applies sharing; system mode follows the class keyword | [Enforce User Mode for Database Operations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm) |
| Async inherited sharing | Always runs with sharing | [Sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm) |
| Inner classes | Don't inherit the container's sharing setting | [Sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm) |
| stripInaccessible | Never strips Id; doesn't support AggregateResult | [Enforce Security with the stripInaccessible Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm) |
| Automated Process user | Needs explicitly applied permission sets to pass object and FLS checks | [Enforce Object and Field Permissions](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm) |

## Check yourself

- Why should every Apex database operation set an access mode explicitly?
- When does a class's sharing keyword decide record access for a query?
- Which control lets an Apex REST update save permitted fields and drop the rest?
- Why does a user-mode insert in a platform event trigger fail?

## Sources

- [Release note: Database Operations Run in User Mode by Default](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5)
- [Secure Apex Classes (LWC guide)](https://developer.salesforce.com/docs/platform/lwc/guide/apex-security.html)
- [Enforce User Mode for Database Operations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm)
- [Use the with sharing, without sharing, and inherited sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm)
- [Enforce Security with the stripInaccessible Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm)
- [Enforce Object and Field Permissions](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm)
- [Lightning Data Service](https://developer.salesforce.com/docs/platform/lwc/guide/data-ui-api.html)
- [Building a Controller Extension](https://developer.salesforce.com/docs/platform/salesforce-pages-developers-guide/guide/pages-controller-extension.html)
- [Subscribe to Platform Event Notifications with Apex Triggers](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_subscribe_apex.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 16 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams