Field-Level Security
By the end of this lesson, you'll be able to:
- Explain how Field-Level Security (FLS) restricts visibility and editability per field
- Check FLS in Apex before reading or writing a field
Prerequisites: Profiles vs. Permission Sets
What FLS controls
Field-Level Security is set per Profile or Permission Set, per field, with Visible and Read-Only checkboxes. Even when a user can access a record and the object it belongs to, an individual field on that record can still be hidden entirely, or shown but not editable.
Apex does not respect FLS by default
Standard Apex SOQL queries and DML statements run in system context by default — they ignore Field-Level Security (and object permissions) entirely, unlike the standard UI, which always respects it. This is one of the most common Salesforce security gaps: code that works perfectly in testing can quietly expose fields a user should never see.
The next lesson covers with sharing, and the lesson after that covers the tools — WITH SECURITY_ENFORCED and Security.stripInaccessible — that specifically close this gap.
Checking field-level access before a write
Boolean canEditIndustry = Schema.sObjectType.Account.fields.Industry.isUpdateable();
if (!canEditIndustry) {
throw new SecurityException('You do not have access to edit Account.Industry');
}isUpdateable() (and isAccessible() / isCreateable()) on a field describe result tells you, at runtime, whether the running user's FLS allows that specific field to be edited.
Exercise
Write an Apex snippet that checks whether the running user can see (read) the Contact.Email field, and debugs the result.
Show hint
Schema.sObjectType.Contact.fields.Email.isAccessible()
Field-Level Security — Quick Check
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
Field-Level Security controls whether a user can see or edit a specific field, independent of record- or object-level access — and unlike the UI, Apex does not enforce FLS automatically unless you check for it yourself.