Selector Layer

Module 42's banking system queried Bank_Account__c in at least three separate places: the balance-update trigger, the validation trigger, and BankAccountService.getAccountsFor. Each query selected slightly different fields, and a future need to add WITH SECURITY_ENFORCED everywhere would mean editing three separate places and hoping none were missed.

public with sharing class BankAccountSelector {
    public List<Bank_Account__c> selectById(Set<Id> ids) {
        return [
            SELECT Id, Balance__c, Status__c
            FROM Bank_Account__c
            WHERE Id IN :ids
            WITH SECURITY_ENFORCED
        ];
    }

    public Map<Id, Bank_Account__c> selectByIdAsMap(Set<Id> ids) {
        return new Map<Id, Bank_Account__c>(selectById(ids));
    }
}

Every place that previously wrote its own Bank_Account__c query now calls BankAccountSelector.selectByIdAsMap instead — one method, one set of fields, one place where WITH SECURITY_ENFORCED (Module 28) is guaranteed to be applied consistently.

If a bug is later found — say, Status__c should also filter out soft-deleted accounts — fixing BankAccountSelector.selectById fixes it everywhere that selector is used, instantly and consistently, rather than requiring a hunt through the codebase for every place [SELECT ... FROM Bank_Account__c] was written by hand.