FAQ-001579 - SOQL Security and User Mode Implementation / USER_MODE vs Manual Security Checks

USER_MODE is generally an acceptable alternative to manual `isAccessible()` checks for CRUD/FLS enforcement in many scenarios. Here are the key considerations: **When USER_MODE is sufficient:** - USER_MODE automatically enforces CRUD/FLS checks during DML operations and SOQL queries - It respects the current user's permissions, including CRUD and FLS checks, during database interactions - For most standard operations, explicit checks like `isAccessible()` are not needed when USER_MODE is properly applied **Scanner recognition considerations:** - Security scanners might not recognize that `AccessLevel.USER_MODE` automatically handles FLS and CRUD checks because this feature is relatively new - Scanner detection capabilities for USER_MODE implementations are still evolving - Manual validation of CRUD/FLS checks may still be recommended to ensure scanner compliance **Best practices:** - Document USER_MODE usage and validate its effectiveness in your specific application context - Evaluate each use case to determine if manual checks are still necessary - Ensure USER_MODE is applied correctly and consistently across all relevant operations Overall, USER_MODE can replace manual security checks in most scenarios, but careful evaluation of your specific implementation is recommended.

The FAQ content is technically accurate and covers the key aspects of USER_MODE vs manual security checks. I made minimal wording improvements for clarity: changed 'Scanner recognition issues:' to 'Scanner recognition considerations:' to maintain a more neutral tone, and refined 'to ensure compliance' to 'to ensure scanner compliance' to be more specific about what type of compliance is being discussed. These changes improve readability while preserving all original points and information. The ApexCRUDViolation rule is directly related to this FAQ because it detects missing CRUD and FLS checks in Apex code. The FAQ specifically discusses USER_MODE as an alternative to manual `isAccessible()` checks for CRUD/FLS enforcement, and explains when USER_MODE is sufficient versus when manual checks might still be needed. This directly relates to what the ApexCRUDViolation rule is designed to detect and prevent.