error in flow designer publish

[chandan86patra]

Hi All,

I am receiving the following error whenever I try to publish the Flow Designer flow in the DEV instance:

“User does not have access to action instance [sys_id].”

I have already configured the flow to Run As: System User, but I am still receiving the same error while publishing the flow.

Could anyone please help me understand what might be causing this issue and how to resolve it?

Thanks,
Chandan

[Hemanth M]

Hi @chandan86patra ,

Could you clarify a few details regarding this flow?

• What exactly does this flow d, and which actions or subflows is it using?
• Is this a brand new flow, or does it already exist in Prod and you are updating it in Dev?
• Do you have the admin or flow admin roles?

[Tarun Rekandar]

Hi @chandan86patra,

Why this is happening:
This error is not about the flow’s “Run As” setting. “Run As: System User” only controls the identity used when the flow executes. Publishing is a design-time operation, and it runs under the account of the person clicking Publish. When you publish, Flow Designer validates every action, subflow and step in the flow, and it checks that your logged-in user has permission to read those action instances. If your user cannot access one of them, the publish fails with “User does not have access to action instance [sys_id].”

The usual causes are:

• The action (often a custom action or one from a spoke/application scope) belongs to a different application scope, and your user lacks the role or cross-scope access needed to see it.
• The action instance has a role or ACL restriction (for example, flow_designer / flow_designer_admin or a custom role) that your user doesn’t have.
• The action was imported through an update set or app install and is in a broken or partially migrated state, so the instance record points to something your user can’t reach.
• The action is protected, or the flow was created or last edited by another user and the related records carry restricted access.

How to resolve it

1. Look up the sys_id from the error in the sys_hub_action_instance table (or sys_hub_action_instance_v2, depending on your release). Open the record and note which action it references and which application scope it belongs to.
2. Check your roles. Make sure your user has flow_designer, and if the flow uses custom or scoped actions, also flow_designer_admin or admin. As a quick test, have an admin publish the flow, or elevate to security_admin and publish yourself.
3. Switch to the correct application scope using the scope picker (gear icon, Developer tab) before opening and publishing the flow.
4. Review the ACLs and Application Access settings for the action’s scope. Under Restrict Access, confirm that cross-scope read/execute is allowed, or grant access to your user’s role.
5. Open the flow and inspect each action and subflow. If one is red, missing or shows an error, remove that step and re-add it. This often clears the stale or broken instance reference.
6. If the flow came from an update set, confirm all the dependent records (custom actions, subflows, spoke plugins) were committed and the related plugin is active in DEV.
7. Check the System Logs (System Logs > All) around the time of the publish attempt, filtering by the sys_id or “Flow Designer”, for a more specific access message.

“If it still fails, please share your release version, whether the action is custom or OOB, and a screenshot of the error along with the action instance record (the one matching the sys_id from the error)."

Accept the solution if it assisted you with your question & Mark this response as Helpful.

Regards,
Tarun