FAQ-000126 - Batch Processing Security / Sharing Context and Permissions

The correct approach for handling scheduled and batch classes that need elevated permissions includes: 1. **Use "Without Sharing" When Necessary**: Declare the class with `without sharing` if the business logic requires bypassing sharing rules. This should only be done when absolutely necessary and justified. 2. **Run in System Mode When Necessary**: Use system mode for operations requiring elevated permissions, such as data migration or handling records users may not have access to. 3. **Enforce CRUD/FLS Checks**: Use `WITH USER_MODE` in SOQL queries or `AccessLevel.USER_MODE` with Database methods to automatically enforce Create, Read, Update, Delete (CRUD) and Field-Level Security (FLS) checks. You can also programmatically enforce these checks to prevent unauthorized data access or updates, even if the job runs in user mode. 4. **Validate User Permissions**: Explicitly validate user permissions to ensure that only authorized actions are performed. 5. **Document the Rationale**: Clearly document the reasons for using elevated permissions and the business rationale for the batch job's design to maintain transparency and ensure compliance with security policies. 6. **Careful Evaluation**: Carefully evaluate the necessity of running without sharing and ensure proper validation to prevent unauthorized data access or updates. These steps help maintain security while allowing the necessary elevated permissions for scheduled and batch classes.

The FAQ content is accurate and comprehensive, but point 3 needed updating to align with modern security approaches guidance. The original answer only mentioned manual programmatic enforcement of CRUD/FLS checks, which remains valid but is not the preferred modern approach. I updated it to lead with `WITH USER_MODE` and `AccessLevel.USER_MODE` as these are the current best practices that automatically handle security enforcement with less code. The manual approach is still mentioned as a valid alternative. No other changes were needed as the content accurately describes the security considerations for batch and scheduled classes. For security rules selected: - ApexSharingViolations: This rule directly relates to the FAQ's discussion of using 'without sharing' in scheduled and batch classes. The FAQ explicitly covers when and how to use 'without sharing' appropriately, which is exactly what this rule detects violations for. - ApexCRUDViolation: This rule is directly relevant to point 3 in the FAQ answer about enforcing CRUD/FLS checks programmatically. The FAQ discusses techniques to prevent unauthorized data access through proper CRUD enforcement, which is precisely what this rule validates.