Development questions

What is the difference between WITH SECURITY_ENFORCED and Security.stripInaccessible()?

DevelopmentHardDeloitteAccenturePwC
  • WITH SECURITY_ENFORCED: checks FLS/CRUD for fields in the SELECT (and some parents) and throws a System.QueryException if any are inaccessible. It does not check fields in WHERE/ORDER BY.
  • Security.stripInaccessible(): does not throw; it removes inaccessible fields from records (or the whole record) and lets you continue, also usable for DML sanitization.
apex
SObjectAccessDecision d = Security.stripInaccessible(AccessType.READABLE, [SELECT Id, Phone FROM Account]);
List<Account> safe = d.getRecords();

Use stripInaccessible when you want graceful degradation; use WITH USER_MODE (newer) for strict enforcement.

soqlsecurityfls