AGENTFORCE-25.3: SYSTEM_MODE Query Bypasses Sharing/FLS

🔴 High · Broken Access Control

Detects Database.query / SOQL running in AccessLevel.SYSTEM_MODE, which bypasses sharing rules and field-level security — often exposing encrypted or private fields.

Details

Field	Value
Rule ID	AGENTFORCE-25.3
Severity	High
Category	Broken Access Control
Compliance	SOC2_CC6, HIPAA

Remediation

Use AccessLevel.USER_MODE unless a documented privileged operation requires SYSTEM_MODE, and gate that path behind explicit CRUD/FLS checks.

See Also

• Rule catalog index
• Scanning basics
• SARIF output