What are Apex Sharing Keywords?<\/h2>\n\n\n\n
Apex Sharing Keywords are words you put on a class declaration, such as Think of a school library. A normal student card opens only the shelves you may use. A librarian’s master key opens every shelf. with sharing is the student card, without sharing is the master key, and inherited sharing borrows whichever card the caller is holding.<\/p>\n\n\n\n Record access is the core of Salesforce security. Here is why Apex Sharing Keywords matter at Bright Path Tutors.<\/p>\n\n\n\n So choosing between Apex Sharing Keywords is a security decision, not a style choice.<\/p>\n\n\n\n Apex Sharing Keywords are checked when code runs. First, Salesforce looks at the class where the running method is defined. Next, it reads that class’s keyword: with sharing applies the user’s sharing rules, while without sharing ignores them. Then, for inherited sharing, it uses the mode of the calling class. After that, if the class is an entry point, such as a Lightning controller, inherited sharing runs as with sharing. Finally, queries and DML return or change only the records allowed by that mode.<\/p>\n\n\n\n with sharing enforces the current user’s record access: org-wide defaults, role hierarchy, sharing rules, teams and manual shares. Use it as your default for most classes.<\/p>\n\n\n\n without sharing ignores record-level sharing, so code can see records the user cannot. Use it only for small, well-reviewed classes that truly need system-level record access.<\/p>\n\n\n\n inherited sharing runs in the caller’s mode. When the class is the entry point, such as an @AuraEnabled method, a REST service or an async job, it runs as with sharing. So it is a safe choice for reusable service classes.<\/p>\n\n\n\n In API version 67.0 and later, a class with no keyword runs as with sharing. In API 66.0 and earlier, the result depended on the caller and the class type, and often meant without sharing. So always write the keyword.<\/p>\n\n\n\n Triggers cannot declare a keyword. They run in a without sharing context. However, in API 67.0 and later, queries and DML inside triggers default to user mode, which applies the user’s sharing anyway.<\/p>\n\n\n\n The table below sums up the four options.<\/p>\n\n\n\n The table below compares the two main keywords.<\/p>\n\n\n\n When to use which is simple. Start with with sharing everywhere. Then move only the exact logic that needs wider access into a small without sharing class.<\/p>\n\n\n\n Let’s apply Apex Sharing Keywords at Bright Path Tutors. Course__c has a Private org-wide default, so tutors see only courses they own or that are shared with them.<\/p>\n\n\n\n The controller lists courses for a Lightning component. Because the class is with sharing, a tutor sees only her own courses, not the whole catalog.<\/p>\n\n\n\n Seat counts must include all students, even those in other tutors’ groups. So this one method lives in a tiny without sharing class. WITH SYSTEM_MODE makes the query skip user-mode checks, so the class keyword decides record access.<\/p>\n\n\n\n When a with sharing controller calls CourseService, the query respects sharing. When a without sharing batch calls it, the query sees all online courses. If an async job uses CourseService as its entry point, it runs as with sharing.<\/p>\n\n\n\n Here is what Asha Mehta, a tutor, sees in a quick test.<\/p>\n\n\n\n The controller protects other tutors’ courses, while the helper still counts every seat correctly.<\/p>\n\n\n\n Inner classes do not inherit the outer class’s keyword. So declare a keyword on each inner class that runs queries or DML. Also, a method follows the keyword of the class where it is defined, not the class that calls it, except in inherited sharing classes.<\/p>\n\n\n\n Create a tutor user with a role below the Sales Manager. Then call MyCoursesController.getMyCourses inside System.runAs in a test and assert that only that tutor’s courses come back. Hint: insert two courses with different owners in the test.<\/p>\n\n\n\n Sharing questions appear in almost every developer interview. Here are the 21 questions asked most about Apex Sharing Keywords.<\/p>\n\n\n\n Q1: What does with sharing do?<\/strong><\/p>\n\n\n\n It enforces the current user’s record-level access, such as OWD, role hierarchy and sharing rules.<\/p>\n\n\n\n Q2: What does without sharing do?<\/strong><\/p>\n\n\n\n It ignores record-level sharing, so code can access records the user cannot see.<\/p>\n\n\n\n Q3: What does inherited sharing do?<\/strong><\/p>\n\n\n\n It runs in the sharing mode of the calling class, and as with sharing when it is the entry point.<\/p>\n\n\n\n Q4: What is the default when no keyword is used?<\/strong><\/p>\n\n\n\n In API version 67.0 and later, with sharing. In older versions, it depended on the caller and was often without sharing.<\/p>\n\n\n\n Q5: Do sharing keywords enforce field-level security?<\/strong><\/p>\n\n\n\n No. They control record access only. Use user mode or stripInaccessible for object and field permissions.<\/p>\n\n\n\n Q6: Can a trigger have a sharing keyword?<\/strong><\/p>\n\n\n\n No. Triggers run in a without sharing context.<\/p>\n\n\n\n Q7: Which keyword should be your default?<\/strong><\/p>\n\n\n\n with sharing, unless a clear business need requires otherwise.<\/p>\n\n\n\n Q8: Does an inner class inherit the outer class’s keyword?<\/strong><\/p>\n\n\n\n No. Each inner class needs its own declaration.<\/p>\n\n\n\n Q9: A with sharing method is called from a without sharing class. Which mode applies?<\/strong><\/p>\n\n\n\n with sharing, because the mode comes from the class where the method is defined.<\/p>\n\n\n\n Q10: When does inherited sharing run as without sharing?<\/strong><\/p>\n\n\n\n Only when it is called from an established without sharing context.<\/p>\n\n\n\n Q11: Which mode does anonymous Apex run in?<\/strong><\/p>\n\n\n\n with sharing.<\/p>\n\n\n\n Q12: How do you count all records while respecting sharing elsewhere?<\/strong><\/p>\n\n\n\n Move that one query into a small without sharing class and call it from your with sharing code.<\/p>\n\n\n\n Q13: How do you test sharing behaviour?<\/strong><\/p>\n\n\n\n Create users with different roles and run code inside System.runAs, then assert the records returned.<\/p>\n\n\n\n Q14: What mode does an async job with inherited sharing use?<\/strong><\/p>\n\n\n\n with sharing, because each async job is a new entry point.<\/p>\n\n\n\n Q15: How do user mode and sharing keywords work together?<\/strong><\/p>\n\n\n\n User mode applies the user’s sharing, CRUD and FLS. The class keyword decides record access for operations run in system mode.<\/p>\n\n\n\n Q16: What changed in API version 67.0?<\/strong><\/p>\n\n\n\n Classes without a keyword run as with sharing, and database operations run in user mode by default.<\/p>\n\n\n\n Q17: Why does the AppExchange security review care about sharing?<\/strong><\/p>\n\n\n\n Missing or unnecessary without sharing declarations can expose customer data to the wrong users.<\/p>\n\n\n\n Q18: Does a child class adopt the parent’s sharing mode?<\/strong><\/p>\n\n\n\n Yes, if the child has no explicit keyword, it adopts the parent’s mode.<\/p>\n\n\n\n Q19: When is without sharing acceptable in Experience Cloud?<\/strong><\/p>\n\n\n\n Only for narrow, reviewed logic, such as letting guests read a specific public record, never for broad queries.<\/p>\n\n\n\n Q20: Why prefer inherited sharing over no keyword for services?<\/strong><\/p>\n\n\n\n It states the intent clearly and guarantees with sharing at entry points.<\/p>\n\n\n\n Q21: How would you review a class for sharing risks?<\/strong><\/p>\n\n\n\n Check its keyword, every query and DML, its callers, and whether any without sharing logic can be narrowed.<\/p>\n\n\n\npublic with sharing class CourseService<\/code>. They control record-level access: which rows a query returns and which rows code may change. They do not control object permissions or field-level security, which we cover in the next post.<\/p>\n\n\n\nWhy Apex Sharing Keywords Matter<\/h2>\n\n\n\n
\n
How Apex Sharing Keywords Work<\/h2>\n\n\n\n
![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-sharing-keywords-with-without-inherited-diagram-1-1024x640.png\")
with sharing<\/h3>\n\n\n\n
without sharing<\/h3>\n\n\n\n
inherited sharing<\/h3>\n\n\n\n
Omitted Sharing<\/h3>\n\n\n\n
Triggers<\/h3>\n\n\n\n
Apex Sharing Keywords at a Glance<\/h2>\n\n\n\n
Declaration<\/th> Record sharing<\/th> Typical use<\/th><\/tr><\/thead> with sharing<\/td> Enforced<\/td> Controllers and most classes<\/td><\/tr> without sharing<\/td> Ignored<\/td> Small system-level helpers<\/td><\/tr> inherited sharing<\/td> Caller’s mode, with sharing at entry points<\/td> Reusable service classes<\/td><\/tr> No keyword (API 67.0+)<\/td> Enforced, like with sharing<\/td> Avoid, always declare<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n with sharing vs without sharing<\/h2>\n\n\n\n
Feature<\/th> with sharing<\/th> without sharing<\/th><\/tr><\/thead> Records returned<\/td> Only those the user can see<\/td> All records<\/td><\/tr> Respects role hierarchy<\/td> Yes<\/td> No<\/td><\/tr> Risk of data leaks<\/td> Low<\/td> High if misused<\/td><\/tr> Typical class<\/td> Lightning controller<\/td> Seat recalculation helper<\/td><\/tr> Enforces FLS and CRUD<\/td> No, use user mode<\/td> No<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n ![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-sharing-keywords-with-without-inherited-diagram-2-1024x640.png\")
A Real Apex Sharing Keywords Example<\/h2>\n\n\n\n
Step 1: A with sharing Controller<\/h3>\n\n\n\n
public with sharing class MyCoursesController {\n\n @AuraEnabled(cacheable=true)\n public static List<Course__c> getMyCourses() {\n \/\/ Returns only courses this user can see through sharing\n return [SELECT Id, Name, Fee__c FROM Course__c ORDER BY Name];\n }\n}<\/code><\/pre>\n\n\n\nStep 2: A Small without sharing Helper<\/h3>\n\n\n\n
public without sharing class SeatCounter {\n\n \/\/ Counts every active enrolment, even ones the user cannot see\n public static Integer activeSeats(Id courseId) {\n return [SELECT COUNT() FROM Enrolment__c\n WHERE Course__c = :courseId AND Status__c = 'Active'\n WITH SYSTEM_MODE];\n }\n}<\/code><\/pre>\n\n\n\nStep 3: An inherited sharing Service<\/h3>\n\n\n\n
public inherited sharing class CourseService {\n\n public static List<Course__c> findOnlineCourses() {\n return [SELECT Id, Name FROM Course__c WHERE Is_Online__c = true];\n }\n}<\/code><\/pre>\n\n\n\nStep 4: Check the Result<\/h3>\n\n\n\n
MyCoursesController.getMyCourses() -> 3 courses (only hers)\nSeatCounter.activeSeats(apexBasicsId) -> 28 (all active students)<\/code><\/pre>\n\n\n\nApex Sharing Keywords and Inner Classes<\/h2>\n\n\n\n
Common Mistakes with Apex Sharing Keywords<\/h2>\n\n\n\n
\n
Best Practices for Apex Sharing Keywords<\/h2>\n\n\n\n
\n
Practice Task<\/h2>\n\n\n\n
Most Asked Interview Questions on Apex Sharing Keywords<\/h2>\n\n\n\n
Basic Questions on Apex Sharing Keywords<\/h3>\n\n\n\n
Code and Scenario Questions on Apex Sharing Keywords<\/h3>\n\n\n\n
Advanced Questions on Apex Sharing Keywords<\/h3>\n\n\n\n
Official Resources<\/h2>\n\n\n\n