CRUD and Field-Level Security
By the end of this lesson, you'll be able to:
- Distinguish object-level (CRUD) permissions from field-level security
- Check a user's object and field permissions before performing an operation
- Explain why sharing (previous lesson) and CRUD/FLS are two separate, complementary layers
Prerequisites: "with sharing, without sharing, and inherited sharing"
CRUD: object-level permissions
if (Schema.sObjectType.Account.isCreateable()) {
insert new Account(Name = 'Riverbend Farms');
} else {
System.debug('Current user cannot create Accounts.');
}This is Module 18's Schema describe lesson, now applied specifically for security: isCreateable(), isAccessible() (readable), isUpdateable(), and isDeletable() check whether the running user has permission to perform that operation on the object as a whole, before actually attempting it.
Field-level security: a finer-grained layer
if (Schema.sObjectType.Account.fields.AnnualRevenue.isAccessible()) {
Account acc = [SELECT Id, Name, AnnualRevenue FROM Account LIMIT 1];
} else {
Account acc = [SELECT Id, Name FROM Account LIMIT 1]; // omit the field the user can't see
}A user might have full CRUD access to Account while still lacking permission to see a specific sensitive field like AnnualRevenue — checked exactly the same way as the previous lesson's Industry.getDescribe(), now used to decide what to query rather than just to inspect metadata.
Two separate, complementary layers
Sharing (the previous lesson) controls which records a user can see; CRUD and field-level security control which objects and fields they can interact with at all, regardless of any specific record. A user could have full CRUD/FLS access to Account in general, but sharing rules still restrict them to only certain specific Account records — both layers apply together, and Salesforce enforces both independently.
Exercise
Write a check before deleting an Account that debugs "Cannot delete Accounts" if the running user lacks delete permission, using isDeletable().
Show hint
Schema.sObjectType.Account.isDeletable()
CRUD and Field-Level Security Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
CRUD permissions control whether a user can create/read/update/delete an object at all; field-level security controls which specific fields they can see or edit — two separate permission layers, both worth checking explicitly.