Apex access modes, sharing keywords and stripInaccessible
How Apex enforces object permissions, field-level security and sharing: sharing keywords for record access, explicit user and system access modes and the API 67.0 default change, Security.stripInaccessible and describe checks, and the framework contexts (Lightning Data Service, Visualforce controllers, Apex class access, Automated Process) that change the answer.
Given a scenario, recommend the appropriate programmatic solution to ensure security settings are enforced.
~7 min read · 16 practice questions ·
What the exam expects
- Separate the two Apex security questions: which records (sharing keywords, or user mode) and which objects and fields (access modes, stripInaccessible, describe checks).
- State the default access mode by API version and recommend explicit modes in every operation.
- Choose between failing fast (user mode) and degrading gracefully (stripInaccessible) for queries and DML.
- Prefer platform enforcement where it exists: Lightning Data Service, Visualforce standard controllers; grant Apex class access; handle Automated Process and Experience Cloud user-information gaps.
Key terms: sharing keyword (with, without or inherited sharing on a class; record-level only); access mode (user or system mode for one database operation); user mode (enforces the user's object permissions, field-level security and sharing); stripInaccessible (removes inaccessible fields from records); Lightning Data Service (LWC data layer on User Interface API).
Key facts
- Detail
- Unmarked database operations run in user mode
- Detail
- System mode
- Detail
- Removed as of API version 67.0
- Detail
- Record-level only; no object or field security
- Detail
- Always applies sharing; system mode follows the class keyword
- Detail
- Always runs with sharing
- Detail
- Don't inherit the container's sharing setting
- Detail
- Never strips Id; doesn't support AggregateResult
- Detail
- Needs explicitly applied permission sets to pass object and FLS checks
Sources for this section (6)
- Release note: User Mode by Defaulthelp.salesforce.com (opens in a new tab)
- Secure Apex Classes (LWC guide)developer.salesforce.com (opens in a new tab)
- Enforce User Mode for Database Operationsdeveloper.salesforce.com (opens in a new tab)
- Sharing Keywordsdeveloper.salesforce.com (opens in a new tab)
- Enforce Security with the stripInaccessible Methoddeveloper.salesforce.com (opens in a new tab)
- Enforce Object and Field Permissionsdeveloper.salesforce.com (opens in a new tab)
- Why should every Apex database operation set an access mode explicitly?
- When does a class's sharing keyword decide record access for a query?
- Which control lets an Apex REST update save permitted fields and drop the rest?
- Why does a user-mode insert in a platform event trigger fail?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Sharing and Visibility Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 21 lessons of the Platform Sharing and Visibility Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (16 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams