Testing sharing with runAs, UserRecordAccess and access summaries
How to prove a sharing model works: the insufficient-privileges walkthrough, System.runAs tests, UserRecordAccess queries, Sharing Hierarchy reasons, User Access Summary and Public Group Access Summary, restriction rule tests, and the separate checks for guest, high-volume and role-based external users.
Given a set of conditions, determine how to test the sharing model.
~8 min read · 18 practice questions ·
What the exam expects
- Lay out a test process for a security model and the order in which to check permissions and sharing layers.
- Write or review
System.runAstests and know what they enforce and ignore. - Query UserRecordAccess correctly and know what it doesn't consider.
- Read Sharing Hierarchy reasons and use the User Access Summary and Public Group Access Summary to find the source of access.
- Test restriction rules, guest users, high-volume users and role-based external users with the right checks and evidence.
Key terms: System.runAs (test-only method that switches user context); UserRecordAccess (read-only object reporting a user's access to records); Sharing Hierarchy (record action listing who has above-default access and why); User Access Summary (consolidated permissions with Access Granted By); test persona (a user built with exactly a target user's permissions).
Key facts
- Detail
- User's sharing rules plus object and field permissions
- Detail
- Test methods only; ignores licence limits; counts as DML
- Detail
- Ignores restriction rules; up to 200 record IDs
- Detail
- Lists access greater than the default
- Detail
- View All or Modify All permissions
- Detail
- View Setup and Configuration; Access Granted By
- Detail
- See all records regardless of restriction rules
- Detail
- Only guest user sharing rules
Sources for this section (6)
- Using the runAs Methoddeveloper.salesforce.com (opens in a new tab)
- UserRecordAccessdeveloper.salesforce.com (opens in a new tab)
- Viewing Which Users Have Accesshelp.salesforce.com (opens in a new tab)
- View a User's Access Summaryhelp.salesforce.com (opens in a new tab)
- Restriction Rule Considerationshelp.salesforce.com (opens in a new tab)
- Guest usershelp.salesforce.com (opens in a new tab)
- Why can a runAs test insert users in a sandbox with no free licences?
- Which sharing mode does a method called inside a runAs block use?
- Why might Sharing Hierarchy be missing from a record's action menu?
- Which setting lets Customer Community Plus users edit cases that name them as contact?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Sharing and Visibility Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Sharing and Visibility Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (18 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams