Universal Containers requested to leverage Lightning Web Components (LWC) to improve support reps’ user experience. LWC will be used as view layer…

Apex classes, when invoked from a Lightning Web Component, run in system mode but default to a without sharing context. This means that by default, they do not enforce the running user's record-level sharing settings, potentially exposing data the user should not see. Therefore, a primary consideration for the development team is to explicitly enforce record visibility. This is achieved by declaring the Apex class with the with sharing or inherited sharing keyword, which ensures that all SOQL queries and DML operations respect the user's sharing rules and permissions.

B. Create test classes including runAs to test different users accessing the data.

This is a best practice for validating the sharing implementation, not the primary implementation consideration itself. The core task is to first write the code to enforce sharing (Option A).

C. Use isSharesble, isEditable, and isCreatable to enforce field permissions.

This option lists incorrect method names (isUpdateable, not isEditable) and misapplies isShareable. These methods check Field-Level Security (FLS) and object properties, not enforce record-level visibility.

1. Salesforce Apex Developer Guide, "Using the with sharing, without sharing, and inherited sharing Keywords":

"An Apex class with the @AuraEnabled annotation that is called from a Lightning component (Aura or LWC) defaults to without sharing." This statement confirms that developers must take explicit action to enforce sharing for LWC controllers.

2. Salesforce Secure Coding Guide, "Enforcing Sharing Rules":

"By default, Apex code runs in system context... The only exceptions to this rule are Apex code that is executed with the executeAnonymous call and Chatter in Apex. To enforce sharing rules, you must declare the class with the with sharing keyword." This highlights the developer's responsibility to enforce sharing.

3. Salesforce Apex Developer Guide, "Enforcing Object and Field Permissions":

This section details the use of Schema Describe methods like isAccessible(), isCreateable(), and isUpdateable() to verify a user's access to objects and fields (FLS), which is distinct from the record-level sharing enforced by the with sharing keyword. This clarifies the inaccuracy of option C.

4. Salesforce Apex Developer Guide, "Testing with runAs":

"The runAs method enables you to write test methods that change the user context to an existing user or a new user so that the user’s record sharing is enforced." This confirms that runAs is a testing tool used to verify sharing behavior.