What problem does it solve? Apex controllers often run SOQL and DML in system mode, bypassing the caller's CRUD and field-level security, while permission sets are built by guesswork and end up over-granted or silently incomplete after deployment. This Skill provides a canonical workflow to enforce user-mode security and prove the backing permission set grants exactly what the code needs. ## Core Features & Use Cases - USER_MODE Conversion: Detect every system-mode static query in controllers and convert SOQL to WITH USER_MODE and DML to as user with correct clause placement. - Least-Privilege Permission Sets: Derive object CRUD and field FLS grants directly from the user-mode code surface, cross-checked against field permissionability via sf sobject describe. - Deploy Verification: Read the permission set back from the org with SOQL queries to catch silent drops from master-detail children and compound-address fields, then prove sufficiency with persona walks or System.runAs tests. - Use Case: Before a Salesforce security audit, run the hardening pass on an @AuraEnabled quoting controller, build its permission set from the enumerated fields, deploy it, and confirm org read-back matches the file. ## Quick Start Review my Apex controller for system-mode SOQL and DML, convert it to USER_MODE, and generate the least-privilege permission set it requires.
