Recognising the anti-pattern: Security enforcement in Apex
Why this deserves attention
Apex can execute with privileges that require developers to enforce the intended access model deliberately. A sound design makes this explicit before implementation begins.
Code that ignores sharing, object or field access can expose information beyond what the user interface allows. On 20 May 2025, this archive entry records the principle as a practical design concern rather than a product announcement.
Watch the warning signs
Look at security enforcement in apex through the early signs that a convenient implementation is becoming long-term risk. The objective is not to introduce more process; it is to expose the few decisions that determine reliability, ownership and future change.
Choose sharing context explicitly, enforce CRUD and field access, and test with representative permission sets. Record the decision close to the solution so that delivery, support and future architecture reviews work from the same intent.
What good looks like
Custom behaviour preserves the organisation’s security model across every entry point. The team can describe the expected behaviour, the owner, the evidence of success and the response when reality differs from the design.
A useful next step is to review one live implementation against this principle, identify the largest unowned assumption and turn it into a bounded improvement with a measurable outcome.
Official reference
Salesforce Apex Developer Guide