Business Rule seems to ignore Cross-Scope Application Access settings

[Andrew Spencer]

I'm trying to restrict cross-scope application access to read-only. However, I cannot prevent a malicious business rule from gaining write access to records.

Application 1: "Can Update [unchecked]"

Application 2: "Business Rule - Malicious Script"

Script runs. Cross-scope write privileges are granted. Records are changed.

Please help me understand what's happening here.

[Aylee Andersen · Accepted solution]

Hi @Andrew Spencer,

I'm not 100% sure if this is the correct setting, but try setting the "Runtime Access Tracking" field on your sys_app record to "Enforcing" instead of "Tracking".

Hopefully that helps!

- Aylee

[Andrew Spencer]

That worked! Thank you!

[G24]

Additional information may be found here:

Runtime Access Tracking / Cross-Scope Access / Caller Access