ApexIntermediatesecuritycrudinvocable
Implement CRUD checks before dynamic object DML from invocable Apex
Real World Scenario
Generic invocable accepts object API name and field map from Flow. Community Flow accidentally updates objects guest users cannot access when runAs wrong.
Expected Answer
• Schema.sObjectType token isCreateable isUpdateable before DML
• Field-level isAccessible isUpdateable per field in dynamic map
• Reject invocable call with structured error if permission missing
• Allowlist objects in CMDT—not arbitrary object API name from Flow input
• runAs Flow user context: invocable runs as running user by default
• Audit log object type, record Id, and running user Id
• Test invocable as community user with denied object assert failure
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Schema.sObjectType token isCreateable isUpdateable before DML Also consider: Field-level isAccessible isUpdateable per field in dynamic map In practice: Reject invocable call with structured error if permission missing Balance speed of delivery with maintainability.
Architect Perspective
Generic invocable is power tool—allowlist objects and enforce CRUD or it becomes privilege escalation.