Salesforce OmniStudio: OmniScript and Data Mapper errors after OmniStudio security enforcement enablement

Work through the causes in order. The security flags live in Setup > Omni Interaction Configuration for licensed orgs, or in Setup > Custom Settings > General Settings for orgs without an OmniStudio license.

Cause 1: Missing Apex class access (flag [ApexClassCheck]).
1. Identify the Apex classes invoked by the failing OmniScript remote actions or Integration Procedure (for example the DataRaptor/OmniStudio runtime classes and any custom Apex called by Remote Actions).
2. Go to Setup > Permission Sets and open the permission set assigned to the affected users, or create a new permission set.
3. Click [Apex Class Access] > Edit.
4. Move each required Apex class from Available to Enabled Apex Classes and click Save.
5. Confirm the enforcement flag by going to Setup > Omni Interaction Configuration; the record with Name [ApexClassCheck] has Value set to true.

Cause 2: Missing object and field-level security for Data Mappers (flag [EnforceDMFLSAndDataEncryption]).
1. When this flag is true, Data Mappers run in user context and respect FLS; encrypted fields show as plain text only for users with the View Encrypted Data permission.
2. Go to Setup > Permission Sets, open the assigned permission set, and click [Object Settings].
3. For each object the Data Mapper reads or writes, set the object permission to Read (and Edit/Create as required by the operation).
4. In the same object, open the field list and set each referenced field to Read Access = checked (and Edit Access = checked for write operations).
5. For encrypted fields, in the same permission set enable [System Permissions] > View Encrypted Data = checked for users who must see decrypted values.

Cause 3: SOSL lookups return no data (flag [EnableQueryWithFLS]).
1. This flag enforces FLS on Salesforce Object Search Language (SOSL) queries; fields without Read access are excluded from results.
2. Repeat the FLS grants in Cause 2 step 4 for every field used in the OmniScript type-ahead, lookup, or search block.

Cause 4: Cannot assign OmniStudio Execution permission set to Salesforce-licensed users, or a permission set appears cleared after a patch.
1. Go to Setup > Permission Sets and open [OmniStudio Execution PS].
2. Confirm the License field on the permission set is set to None (Salesforce) so it can be assigned to standard Salesforce-licensed users; if it is tied to a specific license, clone it and set License = None, then assign the clone.
3. Re-assign the permission set by clicking Manage Assignments > Add Assignments, selecting the affected users, and clicking Assign.
4. If the assignment was lost after a managed package patch, re-apply it manually as in step 3; there is no automatic restore for assignments removed during patch application.

To confirm the flag state on unlicensed orgs, go to Setup > Custom Settings > General Settings and verify [ApexClassCheck], [EnforceDMFLSAndDataEncryption], and [EnableQueryWithFLS] each equal true where enforcement should apply.

Confirm the issue is resolved by logging in as an affected user (or using Login As), running the previously failing OmniScript end to end, and verifying the XE/StartService step completes without "ErrorBlock1" and the Data Mapper and lookup steps return the expected records.