Field-Level Security

Field-level security (FLS) determines whether a profile or permission set can read or edit a specific field, separate from object-level access and separate from whether the field is visible on a given page layout: a field can be readable at the FLS level and still hidden by layout, or fully accessible by FLS and still invisible if a permission set doesn't grant it. Adding a new field to an object doesn't automatically grant any profile or permission set access to it, so a deployment that adds fields without also deploying the accompanying permission set or profile metadata routinely ships fields nobody can see. Apex respects FLS only when code is explicitly written to check it, with WITH SECURITY_ENFORCED, stripInaccessible, or manual checks, so a trigger or class that skips those checks can read or write a field a user shouldn't have access to, a common finding in AppExchange security reviews. Our security review checklist covers FLS as part of a broader audit.