You are here:
Flow Run Context
Flows run in user context or system context. For a flow running in user context, the running user’s profile and permission sets determine the object permissions and field-level access of the flow. For a flow that runs in system context, the flow access is determined by whether the flow runs in system context with sharing or without sharing.
Required Editions
| View supported editions. |
The context that the flow runs in impacts what the following flow elements can do with Salesforce data:
- Action
- Create Records
- Delete Records
- Get Records
- Subflow
- Update Records
- Any other flow element that accesses fields from a record
By default, a flow runs in user context or system context, depending on how the flow is launched. When a flow runs in system context, it runs in that context for all users, including users with the Guest User profile.
| Flow Launch Method | Default Context |
|---|---|
| Apex | Depends on code |
| Experience Cloud site | User |
| Embedded as a visual component inside a custom Aura component | User |
| Embedded as a visual component inside a Visualforce page | User |
| Custom button | User |
| Custom link | User |
| Direct link | User |
| Flow action | User |
| Lightning page | User |
| Platform event | System context without sharing |
| Process built in Process Builder | System context without sharing |
| Record-triggered | System context without sharing |
| Rest API | User |
| Run from an Apex method of a custom Aura component controller | Depends on code |
| Run from an Apex method of a Visualforce controller | Depends on code |
| Schedule-triggered | System context without sharing |
| Web tab | User |
Running User of a Flow
The running user of a flow is the user that launched the flow. The running user determines what a flow that runs in user context can do with Salesforce data.
For a flow running in user context, the running user’s profile and permission sets determine the object permissions and field-level access of the flow. When a flow attempts to create, read, edit, or delete Salesforce data, it enforces the running user’s permissions and field-level access. For example, if the running user doesn’t have the edit permission for the Account object, and the flow attempts to update account records, an error occurs. If the running user doesn’t have permission to edit the Rating field on the Account object, and the flow attempts to update that field, an error occurs.
Org-wide default settings, role hierarchies, sharing rules, manual sharing, teams, and territories also impact what data is accessible to flows that run in user context. If the org-wide default of the Opportunity object is private, and no opportunity records have been shared with the running user, the flow can’t read or edit any opportunity records.
Limitations
- Lightning components such as screen components and local actions always run in user context.
- If the context depends on code, Apex uses the
with sharingandwithout sharingkeywords to specify whether to enforce org-wide default settings, role hierarchies, sharing rules, manual sharing, teams, and territories. A flow called by Apex always ignores object and field-level access permissions. - When a record-triggered flow, schedule-triggered flow, or process invokes an Apex invocable method from an Apex class with the inherited sharing declaration, the invocable method runs in system context with sharing. The flows and process run in system context without sharing.
- If a process triggers the flow to launch, the user that triggered the process sometimes requires other permissions. For example, if a process launches a flow that attempts to save permission set license assignments, and the running user doesn’t have the Assign Permission Sets permission, an error occurs.
- A flow always runs in user context when it executes the Post to Chatter action.
- Data Safety When Running Screen and Autolaunched Flows in System Context
Screen flows and autolaunched flows without triggers can expose more data than intended. This potential issue primarily affects Experience Cloud sites accessed by external users. Configure proper user permissions for field-level and record-level security instead of running flows in system context. When system context is necessary, use only the minimum fields and records required. - Set Flow Run Context to System Mode
Force a flow to run in system context with or without sharing, overriding its default context. With sharing, the flow respects sharing rules but ignores object and field permissions. Without sharing, the flow accesses all data.
