---
schema_version: "1"
id: 70a3a66af3597192b8e02d41186e52820bba3c60b9b7c7ac3eec27b4c5fcd960
title: Limit User Access to Run Flows
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/flow_distribute_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.flow_distribute_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ac0ced04c6339bc969d83fa6a91fd99bc0168f5dfd702b35ee687427c398c167
description: Limit which users can run flows based on their user record, profile, or permission set. To apply more granular security to an individual flow, override the default behavior, then grant access to that specific flow based on user profile or permission set.
products:
  - Flow Builder
  - Salesforce Platform
release: "264"
---
# Limit User Access to Run Flows

Limit which users can run flows based on their user record, profile, or permission set. To apply more granular security to an individual flow, override the default behavior, then grant access to that specific flow based on user profile or permission set.

- **[Give Users the Run Flows Permission](https://help.salesforce.com/s/articleView?id=platform.flow_distribute_security.htm&release=264.0.0&type=5)**  
    Assign the Run Flows permission to control which users can run flows directly, including screen flows from the UI and autolaunched flows that run in user context, such as flows launched from Apex, Lightning pages, or APIs. System-triggered flows—record-triggered, platform event-triggered, and schedule-triggered flows—run automatically and don't require the initiating user to have the Run Flows permission. Regardless of flow type, the running context needs the appropriate object, field, and record permissions for a flow to complete successfully.
- **[Configure User Profile or Permission Set Access to a Flow](https://help.salesforce.com/s/articleView?id=platform.flow_distribute_security.htm&release=264.0.0&type=5)**  
    For individual flows that you create or clone, you can override default behavior and restrict access to users with enabled profiles or permission sets only.
- **[Configure Guest User Profile Access to a Flow with Flow Interview Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.flow_distribute_security.htm&release=264.0.0&type=5)**  
    By default, only the user who started the flow interview can resume it. To grant access to a flow interview to someone other than the user who started it, use flow interview sharing rules. You can control access to specific flows for the Guest User profile only through the profile page.

## Give Users the Run Flows Permission

Assign the Run Flows permission to control which users can run flows directly, including screen flows from the UI and autolaunched flows that run in user context, such as flows launched from Apex, Lightning pages, or APIs. System-triggered flows—record-triggered, platform event-triggered, and schedule-triggered flows—run automatically and don't require the initiating user to have the Run Flows permission. Regardless of flow type, the running context needs the appropriate object, field, and record permissions for a flow to complete successfully.

Users need the Run Flows permission to:

- Run screen flows
- Run autolaunched flows that run in the user context
- Pause or resume flow interviews
- Complete orchestration and approval work items

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-platform_automation-264-0-0-production-enus/60568438-ec7e-4665-acd1-7c80dcbe60d5/images/icon_note.png)

Note In Setup, the Run Flows permission is an app permission and not a system permission.

1. To assign the Run Flows permission to a profile, complete these tasks:
    1. From Setup, in the Quick Find box, enter Profiles, and then select **Profiles**.
    2. Select the profile that you want to update.
    3. Under General User Permissions, select **Run Flows**.
    4. Click **Save**.
2. To assign the Run Flows permission to a permission set, complete these tasks:
    1. From Setup, in the Quick Find box, enter Permission Sets, and then select **Permission Sets**.
    2. Select the permission set you want to update.
    3. Click **App Permissions**.
    4. Under Flow and Flow Orchestration, select **Run Flows**.
    5. Click **Save**.

## Configure User Profile or Permission Set Access to a Flow

For individual flows that you create or clone, you can override default behavior and restrict access to users with enabled profiles or permission sets only.

If you select **Override default behavior and restrict access to enabled profiles or permission sets**, the user who resumes or runs the flow needs to have permission to the individual flow also. Even users with Run Flow or Manage Flow in their profile or permission set needs to be assigned to a profile or permission set that’s enabled to access the flow. To override the default behavior and restrict access, follow these guidelines.

1. From Setup, in the Quick Find box, enter Flows, and then select **Flows**.
2. From the actions menu ![Show actions for the flow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-platform_automation-264-0-0-production-enus/60568438-ec7e-4665-acd1-7c80dcbe60d5/platform_automation/images/flow/flow_distribute_security_dropdown.png) for the flow that you want to edit, click **Edit Access.**
3. In Apps, click **Flow Access**.
4. Click **Edit**.
5. Select **Override default behavior and restrict access to enabled profiles or permission sets**.
6. Add the available profile to the enabled profiles.
7. Save your work.
    
    ![A checkbox to override default behavior and restrict access to enabled profiles or permission sets is selected. Standard User has been added to Enabled Profiles.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-platform_automation-264-0-0-production-enus/60568438-ec7e-4665-acd1-7c80dcbe60d5/platform_automation/images/flow/flow_distribute_security_profile_permission_sets.png)

## Configure Guest User Profile Access to a Flow with Flow Interview Sharing Rules

By default, only the user who started the flow interview can resume it. To grant access to a flow interview to someone other than the user who started it, use flow interview sharing rules. You can control access to specific flows for the Guest User profile only through the profile page.

You can control access to specific flows for the Guest User profile through the profile page only.

Permission to access a flow is checked only at the entry points, such as when a flow starts or resumes.

Permission for a flow is checked only at the top level. For example, flow A calls flow B. User X has a profile that can access flow A but not flow B. User X can run flow B, but only through flow A. User X can’t run flow B directly.

1. From Experience Builder for the site associated with the Guest User profile, go to **Settings** | **General**.
2. Under Guest User Profile, click the profile name.
3. Click **Enabled Flow Access** | **Edit**.
4. Add or remove flows from the Guest User Profile.
5. Save your work.

#### See Also

- [Data Safety When Running Screen and Autolaunched Flows in System Context](https://help.salesforce.com/s/articleView?id=platform.flow_distribute_context_data_safety_system_context.htm&release=264.0.0&type=5 "Screen flows and autolaunched flows without triggers can expose more data than intended. This potential issue primarily affects Experience Cloud sites accessed by external users. Configure proper user permissions for field-level and record-level security instead of running flows in system context. When system context is necessary, use only the minimum fields and records required.")
- [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&language=en_US)