Advanced 30 min read

Enforce Field-Level Security

By the end of this lesson, you'll be able to:

  • Check field-level access before reading Priority and Type in the trigger
  • Explain why a trigger, running as the record-creating user, still needs this check
  • Apply Module 28's CRUD/FLS patterns to a real trigger context

Prerequisites: "Design the Case Model"

Why this matters even inside a trigger

A trigger runs in the context of the user who performed the DML — if a user without access to the Type field somehow creates a Case (through an integration or a UI that doesn't enforce FLS on that specific field), a naive trigger reading Trigger.new[0].Type could behave unpredictably. Checking field accessibility explicitly, even inside trigger logic, is Module 28's habit carried through consistently.

Checking accessibility before the routing logic runs

public class CaseTriggerHandler {
    public void beforeInsert(List<Case> newCases) {
        Boolean canReadPriority = Schema.sObjectType.Case.fields.Priority.isAccessible();
        Boolean canReadType = Schema.sObjectType.Case.fields.Type.isAccessible();

        if (! canReadPriority || ! canReadType) {
            System.debug('Skipping auto-routing: missing field-level access to Priority or Type.');
            return;
        }

        // ... routing logic uses newCases (next lessons) ...
    }
}

This is exactly Module 28's Schema.sObjectType.Object.fields.Field.isAccessible() pattern — checked once, before any per-record routing logic runs, rather than assumed to always be safe.

A deliberate design choice: skip, don't block

Notice this returns early rather than calling addError() (Module 26) to block the save. Missing field access to Priority/Type means auto-routing simply can\'t happen correctly — but that's not a reason to prevent the Case itself from being created. This is a deliberate choice worth naming: not every security check should escalate to a hard block; sometimes gracefully skipping optional automation is the more appropriate response.

Exercise

Write a check that debugs "Cannot read Case.Type" and returns early if the running user lacks field-level access to Type.

Show hint

Schema.sObjectType.Case.fields.Type.isAccessible()

APEX

Enforce Field-Level Security Quiz

1. Why does this lesson skip auto-routing rather than block the Case save when field access is missing?

Log in to submit the quiz and save your score.

My Notes

Log in to keep private notes on this lesson.

Questions about this lesson

No questions yet — be the first to ask.

Log in to ask a question about this lesson.

Summary

Before writing the routing logic itself, this lesson confirms the trigger only reads fields the running user can actually access — Module 28's field-level security lesson, applied directly inside a trigger.