Least Privilege.
All posts.
INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: The Error Names the Wrong Record
The record you are saving is not the problem. It is the one you are pointing at. How to find the real record and why granting Modify All is the wrong fix.
Migrating Legacy Named Credentials Before They Become the Next Salesforce Deadline
Legacy Named Credentials mix secrets and access in one record with no permission set control. Migrate during the Winter '27 window, and how the split works.
Salesforce Cancelled the Profile Permissions Retirement. Migrate Anyway.
The Spring '26 deadline that forced permission set migrations is gone. What the reversal reveals, and why the deadline was never the reason to migrate.
Salesforce Licence Audit: What You Are Paying For and What Is Idle
Idle licences and excess permissions are the same failure: nobody removes access when the need ends. One audit answers both questions at the same time.
Salesforce Winter '27 Turns On Profile Filtering: What Breaks, and How to Test It First
Winter '27 enforces Profile Filtering, so users see only their own profile name. What breaks in Flows, validation rules and Apex, and how to test it early.
Deployable Permission Sets for a Salesforce Delivery Team: Metadata, the CI User, and OmniStudio
Permission set XML you can deploy, how to get the right permission API names out of your own org, and how to scope the CI user and OmniStudio builder roles.
Sizing a Salesforce Access Model: Team Shape, Internal vs External Admins, and What It Costs to Run
A full access model is not always the right one. How to size it to your team, flex it for external delivery partners, and what the whole thing costs to run.
Which of Your Salesforce Connected Apps Use Less Than They're Granted? Ask Your Own Logs
Static scanners tell you what a connected app was granted, not what it uses. Here is how to measure the over-grant per object from your own EventLogFile.
A Least-Privilege Access Model for the Salesforce Delivery Team: Tiers, Roles, and Where the Escalation Chain Breaks
How to tier sandboxes, layer profiles and permission set groups, and use the one fact that stops a developer escalating from a sandbox into your production org.
Why Your Developers Don't Need Modify All Data (And What They Actually Need Instead)
Modify All Data is org-wide read and write that does not even override field-level security. Here are the five real requests behind it, and what each one needs.
Agentforce Agent User Least Privilege: What the Wizard Grants, What Your Agent Actually Needs, and How to Audit the Gap
What the Agentforce setup wizard grants your service agent user, what it actually needs, and how to audit both before an attacker maps the gap for you.