Enforce Field-Level Security
By the end of this lesson, you'll be able to:
- Check field-level access before reading Priority and Type in the trigger
- Explain why a trigger, running as the record-creating user, still needs this check
- Apply Module 28's CRUD/FLS patterns to a real trigger context
Prerequisites: "Design the Case Model"
Why this matters even inside a trigger
A trigger runs in the context of the user who performed the DML — if a user without access to the Type field somehow creates a Case (through an integration or a UI that doesn't enforce FLS on that specific field), a naive trigger reading Trigger.new[0].Type could behave unpredictably. Checking field accessibility explicitly, even inside trigger logic, is Module 28's habit carried through consistently.
Checking accessibility before the routing logic runs
public class CaseTriggerHandler {
public void beforeInsert(List<Case> newCases) {
Boolean canReadPriority = Schema.sObjectType.Case.fields.Priority.isAccessible();
Boolean canReadType = Schema.sObjectType.Case.fields.Type.isAccessible();
if (! canReadPriority || ! canReadType) {
System.debug('Skipping auto-routing: missing field-level access to Priority or Type.');
return;
}
// ... routing logic uses newCases (next lessons) ...
}
}
This is exactly Module 28's Schema.sObjectType.Object.fields.Field.isAccessible() pattern — checked once, before any per-record routing logic runs, rather than assumed to always be safe.
A deliberate design choice: skip, don't block
Notice this returns early rather than calling addError() (Module 26) to block the save. Missing field access to Priority/Type means auto-routing simply can\'t happen correctly — but that's not a reason to prevent the Case itself from being created. This is a deliberate choice worth naming: not every security check should escalate to a hard block; sometimes gracefully skipping optional automation is the more appropriate response.
Exercise
Write a check that debugs "Cannot read Case.Type" and returns early if the running user lacks field-level access to Type.
Show hint
Schema.sObjectType.Case.fields.Type.isAccessible()
Enforce Field-Level Security Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
Before writing the routing logic itself, this lesson confirms the trigger only reads fields the running user can actually access — Module 28's field-level security lesson, applied directly inside a trigger.