Why is User Mode Important in your Apex Tests?
Summary
User mode is now the default in Apex tests starting with API version 67.0, emphasizing the importance of testing code under real user permission contexts. This shift can cause new test failures if security and permission sets are not properly considered. Using System.runAs in tests allows developers to simulate different user personas and validate permission set enforcement, enabling both positive and negative security testing scenarios. Teams can improve the reliability and security of their Apex by designing granular permission sets and writing tests that reflect actual user access patterns.
Takeaways
- Use System.runAs to run Apex tests with different user permission contexts.
- Create test users dynamically with assigned permission sets to validate security.
- Implement negative security tests to ensure permission sets are correctly restrictive.
- Avoid adding excessive permissions to test users to bypass security testing.
- Clearly define user personas and roles to guide permission set design and testing.
As covered in my last blog, from Summer’26 , user mode by default is now with us in Apex , and that’s a good thing—well, depending on how much you’ve been historically paying attention to security in your code. If your wondering what I mean by that check out my last blog first. User mode is enabled by default from API 67.0 , this also applies to test code – which is likely to start throw failures you’ve not seen before – and thats also a good thing! This blog covers both new and old considerations for how to best test a vital part of your Apex and Permission Sets using Apex tests. Instead of a sample app attached to this blog, I have included an agent skill that goes into a little more detail for you and your coding AI buddy to pour over! By default, your tests will run as the user executing them , and this time in user mode, that user’s accessible objects, fields, and records will be applied to the code being tested.