Flow run context and sharing
Key Takeaway
User context limits a flow to the access of the user who launched it. System Context with Sharing respects sharing settings but ignores that user's permissions. System Context without Sharing can access all data.
Every flow runs in either user context or system context, and the context decides what Salesforce data the flow can see and change. User context limits the flow to what the user is allowed to do, and system context bypasses some or all of those limits. As an app builder, you need to know which context each kind of flow uses by default, when to override it, and how to avoid exposing data when a flow runs with elevated access.
What user context and system context control
The context decides how far the running user's access limits the flow. It affects every element that touches data:
- Get Records
- Create Records
- Update Records
- Delete Records
- Action
- Subflow
- Any other element that accesses fields from a record
These sharing settings control record access:
- Org-wide defaults
- Role hierarchies
- Sharing rules
- Manual sharing
- Teams
- Territories
System context comes in two forms, System Context with Sharing and System Context without Sharing. Here is how they compare with user context:
| Object permissions and field-level access | Which records the flow can reach | |
|---|---|---|
| User context | Come from the running user's profile and permission sets | The sharing settings decide |
| System Context with Sharing | Ignores the running user's object permissions, field-level access, and other permissions | Respects the sharing settings |
| System Context without Sharing | Can access all data | Can access all data |
A user-context flow fails when the running user lacks access.
For example, imagine a user-context flow that tries to update the Rating field on an account. If the running user can't edit the Account object, or can't edit the Rating field, the update causes an error. Now imagine that the Opportunity org-wide default is Private and no opportunities are shared with the running user. The flow can't read or edit any opportunity records.