Advanced 30 min read

User Mode Database Operations

By the end of this lesson, you'll be able to:

Run a SOQL query or DML statement explicitly in user mode
Explain the difference between user mode and the historical system-mode default
Choose user mode as the safer default for new Apex code

Prerequisites: "Security.stripInaccessible"

The historical default: system mode

// Runs in system mode by default — ignores CRUD/FLS entirely
Account acc = new Account(Name = 'Test', AnnualRevenue = 999999);
insert acc; // succeeds even if the running user can't normally edit AnnualRevenue

// Runs in system mode by default — ignores CRUD/FLS entirely — every plain SOQL query and DML statement written throughout this course, by default, runs in system mode.
Account acc = new Account(Name = 'Test', AnnualRevenue = 999999); — sets a sensitive field.
insert acc; — full object and field access, completely ignoring the running user's actual CRUD/FLS permissions.

Warning: Line 3 succeeds even if the running user can't normally edit AnnualRevenue — this is a historical Apex default, not something this course has been doing wrong, but it means a user could set a field through this code that they could never set through the UI, unless field-level security is checked manually.

Declaring user mode explicitly

Account acc = new Account(Name = 'Test', AnnualRevenue = 999999);
insert as user acc; // now enforces the running user's actual CRUD/FLS automatically

Account acc = new Account(Name = 'Test', AnnualRevenue = 999999); — the same record.
insert as user acc; — insert as user (and the equivalent update as user, delete as user, and SELECT ... FROM Account WITH USER_MODE in SOQL) tells Apex to enforce object and field-level permissions automatically — if the running user can't actually set AnnualRevenue, this throws a clear error instead of silently succeeding.

User mode as the safer default going forward

List<Account> accounts = [SELECT Id, Name, AnnualRevenue FROM Account WITH USER_MODE];

List<Account> accounts = [SELECT Id, Name, AnnualRevenue FROM Account WITH USER_MODE]; — WITH USER_MODE means CRUD/FLS enforcement happens automatically, without needing to remember Security.stripInaccessible or manual Schema.sObjectType checks at every single query and DML statement.

For new Apex code, defaulting to user mode (rather than system mode plus manual checks) is generally the safer starting point.

Exercise

Rewrite this system-mode query to run explicitly in user mode.

Show hint

Add WITH USER_MODE at the end of the query.

Salesforce: ○ Not connected Connect

APEX

Execution Results

Run your code to see the result.

User Mode Database Operations Quiz

1. What does system mode (the historical default) do with the running user's CRUD/FLS permissions?

Ignores them entirely — full object and field access regardless of the user's actual permissions Enforces them automatically Only enforces them for custom objects Blocks all SOQL and DML entirely

My Notes

Questions about this lesson

No questions yet — be the first to ask.

Summary

By default, Apex's SOQL and DML historically run in "system mode" — full access, ignoring CRUD/FLS entirely — but explicit user mode enforces the running user's actual object and field permissions automatically.

❬ Previous Next ❭