CRUD and Field-Level Security

if (Schema.sObjectType.Account.isCreateable()) {
    insert new Account(Name = 'Riverbend Farms');
} else {
    System.debug('Current user cannot create Accounts.');
}

1. if (Schema.sObjectType.Account.isCreateable()) { — this is Module 18's Schema describe lesson, now applied specifically for security — isCreateable() checks whether the running user has permission to perform that operation on the object as a whole, before actually attempting it.
2. insert new Account(Name = 'Riverbend Farms'); — only reached if permitted.
3. } else { — otherwise...
4. System.debug('Current user cannot create Accounts.'); — ...reacts gracefully. isAccessible() (readable), isUpdateable(), and isDeletable() work the same way for their respective operations.
5. } — closes the if/else.

if (Schema.sObjectType.Account.fields.AnnualRevenue.isAccessible()) {
    Account acc = [SELECT Id, Name, AnnualRevenue FROM Account LIMIT 1];
} else {
    Account acc = [SELECT Id, Name FROM Account LIMIT 1]; // omit the field the user can't see
}

1. if (Schema.sObjectType.Account.fields.AnnualRevenue.isAccessible()) { — checked exactly the same way as the previous lesson's Industry.getDescribe(), now used to decide what to query rather than just to inspect metadata.
2. Account acc = [SELECT Id, Name, AnnualRevenue FROM Account LIMIT 1]; — includes the sensitive field, only if permitted.
3. } else { — otherwise...
4. Account acc = [SELECT Id, Name FROM Account LIMIT 1]; — ...omits the field the user can't see. A user might have full CRUD access to Account while still lacking permission to see a specific sensitive field like AnnualRevenue.
5. } — closes the if/else.

Sharing (the previous lesson) controls which records a user can see; CRUD and field-level security control which objects and fields they can interact with at all, regardless of any specific record. A user could have full CRUD/FLS access to Account in general, but sharing rules still restrict them to only certain specific Account records — both layers apply together, and Salesforce enforces both independently.