FAQ-001485 - Permission Set Security / Permission Set Design and Best Practices

The recommended method for assigning permissions for your app's objects and classes to end-users involves: defining sharing and access control configurations for custom objects within a managed package, ensuring that only users with the appropriate permissions can access these functions, and checking permissions against the caller/user context to comply with security standards. When enforcing these permissions in Apex code, use WITH USER_MODE for SOQL queries and AccessLevel.USER_MODE for Database methods as they automatically enforce CRUD permissions, Field-Level Security (FLS), and sharing rules with minimal code.

The original answer correctly covers permission assignment concepts but lacks specific guidance on how developers should implement these permissions in Apex code. The recommended update adds modern security enforcement methods (WITH USER_MODE and AccessLevel.USER_MODE) that directly relate to the security rules identified. This addition provides actionable technical guidance while preserving all existing content and maintaining the same structure and level of detail. For ApexCRUDViolation: This rule detects when Apex code doesn't properly enforce CRUD (Create, Read, Update, Delete) permissions before performing database operations. The FAQ discusses 'ensuring that only users with the appropriate permissions can access these functions' and 'checking permissions against the caller/user context' - these are exactly the scenarios where ApexCRUDViolation applies. The modern approach using WITH USER_MODE and AccessLevel.USER_MODE directly addresses this rule's concerns by automatically enforcing CRUD permissions. For ApexSharingViolations: This rule identifies when Apex code doesn't respect organization-wide defaults, role hierarchies, and sharing rules. The FAQ specifically mentions 'defining sharing and access control configurations' and 'checking permissions against the caller/user context' - these concepts directly relate to sharing rule enforcement that ApexSharingViolations monitors. The recommended modern approaches automatically enforce sharing rules, making them highly relevant to this rule.