What is Apex CRUD and FLS?<\/h2>\n\n\n\n
Apex CRUD and FLS enforcement means your code checks the running user’s object and field permissions before it reads or changes data. Admins set these permissions in profiles and permission sets. If code ignores them, a user could see a salary field through a Lightning component even though the page layout hides it.<\/p>\n\n\n\n
Think of a hotel key card. Sharing decides which rooms your card opens. CRUD decides whether you may enter, clean or empty a room. FLS decides which drawers inside the room you may open. A secure app checks all three.<\/p>\n\n\n\n
Why Apex CRUD and FLS Matters<\/h2>\n\n\n\n
Hidden fields are not secure fields. Here is why Apex CRUD and FLS matters at Bright Path Tutors.<\/p>\n\n\n\n
- \n
- First, tutors must not read Instructor_Pay__c, even through custom components.<\/li>\n\n
- Also, support agents may view courses but must not change Fee__c.<\/li>\n\n
- Next, Experience Cloud students must only see public course fields.<\/li>\n\n
- AppExchange security review fails code that skips these checks.<\/li>\n\n
- Finally, a single unprotected @AuraEnabled method can expose a whole object.<\/li>\n<\/ul>\n\n\n\n
So every query and DML that users can trigger needs Apex CRUD and FLS protection.<\/p>\n\n\n\n
How Apex CRUD and FLS Checks Work<\/h2>\n\n\n\n
Apex CRUD and FLS checks happen through the access mode of each database operation. First, Salesforce decides whether the operation runs in user mode or system mode. Next, in user mode, it checks the user’s object permission for the query or DML. Then it checks field-level security for every field used. After that, it applies the user’s sharing to choose records. Finally, if any check fails, Salesforce throws an exception instead of returning or saving data.<\/p>\n\n\n\n
![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-crud-and-fls-user-mode-diagram-1-1024x640.png\")
How user mode checks object, field and record access.<\/figcaption><\/figure>\n\n\n\n User Mode<\/h3>\n\n\n\n
User mode applies the running user’s CRUD, FLS and sharing. In API version 67.0 and later, it is the default for SOQL, SOSL and DML. You can also write it explicitly with WITH USER_MODE,
insert as user<\/code> or AccessLevel.USER_MODE.<\/p>\n\n\n\nSystem Mode<\/h3>\n\n\n\n
System mode ignores CRUD and FLS, and record access then follows the class’s sharing keyword. In API 66.0 and earlier, it was the default. Now you must ask for it with WITH SYSTEM_MODE,
update as system<\/code> or AccessLevel.SYSTEM_MODE.<\/p>\n\n\n\nSecurity.stripInaccessible<\/h3>\n\n\n\n
Security.stripInaccessible removes fields the user cannot access from a list of records, instead of throwing an exception. Use it when you want a partial result, such as showing a course without its hidden pay field.<\/p>\n\n\n\n
Describe Checks<\/h3>\n\n\n\n
Describe methods, such as
Schema.sObjectType.Course__c.isUpdateable()<\/code>, let you check permissions yourself. They are handy for hiding a button or skipping optional logic.<\/p>\n\n\n\nWITH SECURITY_ENFORCED<\/h3>\n\n\n\n
WITH SECURITY_ENFORCED is an older query clause that only checks reads. Salesforce now recommends WITH USER_MODE, because it also covers sharing, DML and more query types.<\/p>\n\n\n\n
Ways to Enforce Apex CRUD and FLS<\/h2>\n\n\n\n
The table below lists the tools and when each fits.<\/p>\n\n\n\n
Tool<\/th> Checks<\/th> On failure<\/th><\/tr><\/thead> WITH USER_MODE in SOQL<\/td> CRUD, FLS, sharing<\/td> QueryException<\/td><\/tr> insert as user<\/td> CRUD, FLS, sharing<\/td> DmlException<\/td><\/tr> AccessLevel.USER_MODE<\/td> CRUD, FLS, sharing<\/td> Exception<\/td><\/tr> Security.stripInaccessible<\/td> CRUD and FLS<\/td> Removes fields<\/td><\/tr> Describe methods<\/td> What you ask for<\/td> Your own logic<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n User Mode vs System Mode<\/h2>\n\n\n\n
The table below compares the two access modes.<\/p>\n\n\n\n
Feature<\/th> User mode<\/th> System mode<\/th><\/tr><\/thead> Object permissions<\/td> Enforced<\/td> Ignored<\/td><\/tr> Field-level security<\/td> Enforced<\/td> Ignored<\/td><\/tr> Record sharing<\/td> User’s sharing<\/td> Class keyword decides<\/td><\/tr> Default since API 67.0<\/td> Yes<\/td> No, must be explicit<\/td><\/tr> Best for<\/td> User-facing code<\/td> Trusted system jobs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n When to use which is clear. Use user mode for anything a user triggers. Use system mode only for narrow, reviewed logic, such as a nightly recalculation, and say so in the code.<\/p>\n\n\n\n
![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-crud-and-fls-user-mode-diagram-2-1024x640.png\")
User mode vs system mode.<\/figcaption><\/figure>\n\n\n\n A Real Apex CRUD and FLS Example<\/h2>\n\n\n\n
Let’s protect Course__c data at Bright Path Tutors with Apex CRUD and FLS checks. Tutors cannot read Instructor_Pay__c, and only managers can edit Fee__c.<\/p>\n\n\n\n
Step 1: Query in User Mode<\/h3>\n\n\n\n
public with sharing class CourseController {\n\n @AuraEnabled(cacheable=true)\n public static List<Course__c> getCourses() {\n return [SELECT Id, Name, Fee__c, Instructor_Pay__c\n FROM Course__c\n WITH USER_MODE\n ORDER BY Name];\n }\n}<\/code><\/pre>\n\n\n\nThe query asks for Instructor_Pay__c. In user mode, a tutor without read access to that field gets a QueryException, so no pay data leaks. In API 67.0 and later, the query would run in user mode even without the clause, but writing it makes the intent clear.<\/p>\n\n\n\n
Step 2: Strip Hidden Fields Instead<\/h3>\n\n\n\n
@AuraEnabled(cacheable=true)\npublic static List<Course__c> getCoursesSafe() {\n List<Course__c> rows = [SELECT Id, Name, Fee__c, Instructor_Pay__c\n FROM Course__c WITH SYSTEM_MODE];\n SObjectAccessDecision decision =\n Security.stripInaccessible(AccessType.READABLE, rows);\n System.debug('Removed: ' + decision.getRemovedFields());\n return (List<Course__c>) decision.getRecords();\n}<\/code><\/pre>\n\n\n\nThe query runs in system mode, then stripInaccessible removes any field the user cannot read. So tutors get the courses without the pay field, and managers get everything. getRemovedFields shows which fields were stripped.<\/p>\n\n\n\n
Step 3: Save Only What the User May Edit<\/h3>\n\n\n\n
@AuraEnabled\npublic static void saveFee(Id courseId, Decimal newFee) {\n if (!Schema.sObjectType.Course__c.fields.Fee__c.isUpdateable()) {\n throw new AuraHandledException('You cannot change course fees.');\n }\n update as user new Course__c(Id = courseId, Fee__c = newFee);\n}<\/code><\/pre>\n\n\n\nThe describe check gives a friendly message early. Then
update as user<\/code> enforces CRUD, FLS and sharing again at save time. So even if someone skips the check, the update still fails safely.<\/p>\n\n\n\nStep 4: See the Results<\/h3>\n\n\n\n
Here is what Asha Mehta, a tutor, gets in the debug log.<\/p>\n\n\n\n
getCourses() -> QueryException (Instructor_Pay__c is not accessible)\ngetCoursesSafe() -> Removed: {Course__c={Instructor_Pay__c}}\nsaveFee(...) -> AuraHandledException: You cannot change course fees.<\/code><\/pre>\n\n\n\nEach method protects the data in its own way. In real code, pick one style per method and stay consistent.<\/p>\n\n\n\n
Apex CRUD and FLS for Older Code<\/h2>\n\n\n\n
Classes saved at API 66.0 or earlier still run in system mode by default. So when you edit an old class, either raise its API version and test it, or add WITH USER_MODE and
as user<\/code> to every operation users can reach.<\/p>\n\n\n\nCommon Mistakes with Apex CRUD and FLS<\/h2>\n\n\n\n
- \n
- Thinking with sharing also checks object and field permissions.<\/li>\n\n
- Relying on page layouts to hide sensitive fields.<\/li>\n\n
- Using system mode in @AuraEnabled methods without a clear reason.<\/li>\n\n
- Raising a class to a new API version without retesting permission errors.<\/li>\n\n
- Ignoring the fields that stripInaccessible removed.<\/li>\n<\/ul>\n\n\n\n
Best Practices for Apex CRUD and FLS<\/h2>\n\n\n\n
- \n
- Write an explicit access mode on every query and DML.<\/li>\n\n
- Use user mode for anything a user can trigger.<\/li>\n\n
- Use stripInaccessible when a partial result is better than an error.<\/li>\n\n
- Add describe checks for friendly messages and hidden buttons.<\/li>\n\n
- Test with a restricted permission set inside System.runAs.<\/li>\n<\/ul>\n\n\n\n
Practice Task<\/h2>\n\n\n\n
Create a permission set that gives read access to Course__c but not Fee__c. Then write a test that runs getCoursesSafe inside System.runAs and asserts that Fee__c is not populated. Hint: use
isSet('Fee__c')<\/code> on the returned record.<\/p>\n\n\n\nMost Asked Interview Questions on Apex CRUD and FLS<\/h2>\n\n\n\n
Security questions are now standard in developer interviews. Here are the 21 questions asked most about Apex CRUD and FLS.<\/p>\n\n\n\n
Basic Questions on Apex CRUD and FLS<\/h3>\n\n\n\n
Q1: What do CRUD and FLS mean?<\/strong><\/p>\n\n\n\n
CRUD is create, read, update and delete permission on an object. FLS is field-level security on each field.<\/p>\n\n\n\n
Q2: Do sharing keywords enforce CRUD and FLS?<\/strong><\/p>\n\n\n\n
No. They control record access only.<\/p>\n\n\n\n
Q3: What is user mode?<\/strong><\/p>\n\n\n\n
An access mode that applies the user’s CRUD, FLS and sharing to a database operation.<\/p>\n\n\n\n
Q4: What is system mode?<\/strong><\/p>\n\n\n\n
An access mode that ignores CRUD and FLS, with record access decided by the class keyword.<\/p>\n\n\n\n
Q5: What is the default mode in API 67.0 and later?<\/strong><\/p>\n\n\n\n
User mode.<\/p>\n\n\n\n
Q6: How do you run a query in user mode?<\/strong><\/p>\n\n\n\n
Add WITH USER_MODE to the SOQL query.<\/p>\n\n\n\n
Q7: How do you run DML in user mode?<\/strong><\/p>\n\n\n\n
Use
insert as user<\/code>,update as user<\/code>, or a Database method with AccessLevel.USER_MODE.<\/p>\n\n\n\nCode and Scenario Questions on Apex CRUD and FLS<\/h3>\n\n\n\n
Q8: What does Security.stripInaccessible return?<\/strong><\/p>\n\n\n\n
An SObjectAccessDecision with the cleaned records and the removed fields.<\/p>\n\n\n\n
Q9: Which AccessType values does stripInaccessible support?<\/strong><\/p>\n\n\n\n
READABLE, CREATABLE, UPDATABLE and UPSERTABLE.<\/p>\n\n\n\n
Q10: What happens when a user-mode query includes a hidden field?<\/strong><\/p>\n\n\n\n
It throws a QueryException.<\/p>\n\n\n\n
Q11: How do you check if a user can edit a field?<\/strong><\/p>\n\n\n\n
Call isUpdateable on the field describe, such as Schema.sObjectType.Course__c.fields.Fee__c.isUpdateable().<\/p>\n\n\n\n
Q12: How do you run dynamic SOQL in user mode?<\/strong><\/p>\n\n\n\n
Pass AccessLevel.USER_MODE to Database.query or Database.queryWithBinds.<\/p>\n\n\n\n
Q13: When would you choose stripInaccessible over user mode?<\/strong><\/p>\n\n\n\n
When you want to return the record without hidden fields instead of failing.<\/p>\n\n\n\n
Q14: How do you test FLS in Apex?<\/strong><\/p>\n\n\n\n
Create a user with a restricted permission set and run the code inside System.runAs.<\/p>\n\n\n\n
Advanced Questions on Apex CRUD and FLS<\/h3>\n\n\n\n
Q15: Why is WITH USER_MODE preferred over WITH SECURITY_ENFORCED?<\/strong><\/p>\n\n\n\n
It also enforces sharing, supports more query types and works with DML through matching options.<\/p>\n\n\n\n
Q16: What should you check when raising an old class to API 67.0?<\/strong><\/p>\n\n\n\n
That its queries and DML still work in user mode for every user who runs them.<\/p>\n\n\n\n
Q17: Can stripInaccessible protect data from JSON input?<\/strong><\/p>\n\n\n\n
Yes. It can sanitize records deserialized from untrusted input before DML.<\/p>\n\n\n\n
Q18: Do Automated Process users pass CRUD and FLS checks?<\/strong><\/p>\n\n\n\n
Not by default. They need permission sets assigned for object and field checks to pass.<\/p>\n\n\n\n
Q19: How do object permissions and sharing interact?<\/strong><\/p>\n\n\n\n
Object and field permissions take precedence. Sharing cannot grant access the user’s permissions deny.<\/p>\n\n\n\n
Q20: When is system mode acceptable?<\/strong><\/p>\n\n\n\n
For trusted system processes, such as recalculations or integrations, with a clear comment and review.<\/p>\n\n\n\n
Q21: How do you find code that skips CRUD and FLS?<\/strong><\/p>\n\n\n\n
Run Salesforce Code Analyzer, which flags violations such as ApexCRUDViolation.<\/p>\n\n\n\n
Official Resources<\/h2>\n\n\n\n