[SalesForce] User with no access to child object can create records

I have two objects Parent__c and Child__c with parent-child relationship.
OWD settings for Parent__c is Public Read/Write and for Child__c it is Private.

The User1 has Read/Write/Delete/Edit access on Parent__c and No Access on Child__c object.

I wrote a simple trigger on Parent__c on update to create a child record Child__c.

When I update the Parent record from User1, a new child record is created with the record owner as User1 !
And for obvious reasons, User1 gets insufficient privileges error when trying to access the child record that he owns.

How can this be possible? Is this implicit access?
FYI, there are no Roles or Hierarchy defined.

Edit: The relationship is Lookup. I tried it through process builder and got the same result.

Best Answer

Triggers run on System Mode so, it has access equivalent to system admin so child record was created.

But when you try to access the record, it is user1 context and user don't have access to that object.

Also, when parent-child relationship is master detail you cannot provide OWD access individually to parent and child. Access is controlled by parent. There must be lookup relationship only.

Related Topic