Field-Level Security (FLS) Explained
FLS operates independently from object-level permissions and record-level access. A user might have Read access to the Account object and see a specific Account record, but FLS can hide the Annual Revenue field from their profile entirely. For each field, FLS settings are binary per profile or permission set: Visible (the user can see the field) and Read-Only (the user can see but not edit). If a field is not visible, it is completely hidden, absent from page layouts, reports, list views, and API responses for that user.
FLS is critical for compliance and data governance. Common scenarios include hiding SSN fields from non-HR users, making salary data read-only for managers, and restricting API-only integration fields from the UI. In Apex, FLS is not enforced by default unless the code uses WITH SECURITY_ENFORCED in SOQL or Security.stripInaccessible. Clientell AI audits FLS configurations across all profiles and permission sets, flagging fields that are unnecessarily exposed and generating remediation metadata.