With Sharing and Without Sharing in Apex

Apex gives us two powerful keywords to control record-level access within classes. They are,

1. With Sharing
2. Without Sharing

What are they?

In Apex, classes run in system context by default, meaning they ignore the current user’s sharing rules and can access all records, regardless of the user’s access.

With Sharing — enforces the current user’s record-level sharing rules. Without Sharing — ignores the current user’s sharing rules(runs in system context) No Keyword- Default is system context- same as without sharing.

With Sharing Example

public with sharing class AccountService {
    public static List<Account> getAccounts() {
        return [SELECT Id, Name FROM Account];
    }
}

What happens here?

• The class respects the current user’s sharing rules.
• If the user has visibility to only 2 accounts, only those 2 are returned.

Without Sharing Example

public without sharing class AdminService {
    public static List<Account> getAllAccounts() {
        return [SELECT Id, Name FROM Account];
    }
}

What happens here?

• The class ignores sharing rules.
• Even if the user has access to 0 accounts, they will still see all records (if their profile allows object-level access).

When to use with sharing?

Use it by default unless there’s a strong reason not to.

1. Enforce data access control: When users should see only records they have access to.
2. User-facing logic: For Apex used in LWC, Aura, Visualforce, or custom buttons.
3. Secure test environments: Reflect realistic user permissions in test classes.
4. Reporting or listing records: When fetching records to display on UI.
5. Security compliance: Helps pass Salesforce security review and ensures record-level security.
6. Multi-user apps: Enforces record-level access when different roles interact with the same object.

When to use without sharing?

Use only when you need to bypass sharing rules intentionally.

1. Administrative operations: Like user creation, role assignments, permission sets.
2. Scheduled jobs / Batch Apex: Where you need full access to all records to process data correctly.
3. Integrations / System processes: Where operations must run with full access regardless of who triggered them.
4. Data migration scripts: For data load, or back-end data manipulation.
5. Managed packages: Where sharing enforcement is handled manually or via custom logic.
6. Setup & Configuration logic: When modifying records that most users don’t have access to (e.g., Org-wide defaults or Permission Sets).

Understanding and correctly applying with sharing and without sharing in Apex is essential for building secure, scalable, and user-friendly Salesforce applications.