---
schema_version: "1"
id: ed43272b3143ba373a21cdaf328fb05dcc82e4a653ce101a2927dfd4da56a339
title: Best Practices for Writing and Maintaining Transaction Security Policies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/enhanced_transaction_security_best_practices.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_best_practices.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fa337f5aaa8eccd7d56ec6fcd1f6369634b939b4d23abeaf9972e1061766cc97
description: Transaction security policy management isn’t always easy, especially when you have many policies. To make sure that your policies remain functional, write and maintain them using these best practices. Well-structured and tested policies keep your employees and customers connected, productive, and secure.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Best Practices for Writing and Maintaining Transaction Security Policies

Transaction security policy management isn’t always easy, especially when you have many policies. To make sure that your policies remain functional, write and maintain them using these best practices. Well-structured and tested policies keep your employees and customers connected, productive, and secure.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

## Writing Policies

Use these general guidelines as you write your policies.

 
| Best Practice | Description |
| --- | --- |
| Know your users | Do your users use features that work best with certain browsers? Do they rely on mobile devices in the field? Have features that your users regularly access changed? Think about what your users experience during their day-to-day work, and write your policies with those behaviors in mind. Remember: Policies prevent activities that are genuinely out of bounds, and they must not prevent users from completing core job tasks. |
| Know what's coming | To check whether the features that your users rely on change, read the Salesforce release notes. Feature changes can sometimes cause your policies to behave unexpectedly. |
| Know your environments | Use sandbox environments to your advantage. Run your policies in a sandbox under conditions similar to your production org. Let policies run for 24 hours to see how they work. Use this feedback to evaluate how your policy functions in the conditions it has to work under. |
| Know your policies | To avoid confusion and lighten your maintenance load, create only one policy per event. Schedule regular policy maintenance and reviews to make sure that you don't have policies that counteract one another. Check the Salesforce release notes for feature updates that might change the way your policies behave. |

Use these guidelines if you write an Apex-based policy rather than use Condition Builder.

 
| Apex Best Practice | Description |
| --- | --- |
| Know your code | If you have an Apex developer in your organization, work with the developer as you write your policy. By consulting with someone who knows the ins and outs of Apex, you can team up to write robust and reliable policies and tests. If you don't have access to an Apex expert, learn about Apex by taking the Apex Basics Trailhead module or studying the Apex Developer Guide. |
| Know your limits | Because Apex runs in a multi-tenant environment, the Apex runtime engine strictly enforces limits. Enforcing limits ensures that runaway Apex code or processes don't monopolize shared resources. If some Apex code exceeds a limit, the associated governor issues a runtime exception that cannot be handled. Limits vary based on the event that the policy is based on. Construct your policies with these limits in mind. Read more about Apex Governors and Limits. |

## Testing Policies

Testing policies is the best way to make sure that you’re crafting the right solution for your organization and your users.

- Try out your policies in a sandbox. Then deploy your security policy in a production org when you’re certain your policy works.
- If you make far-reaching changes in your org, retest your policies to make sure that they are compatible with the changes you made. For example, if you create a workflow for field employees that generates a report, check all report event policies that could be affected.
- If your policy is Apex-based, follow Apex testing best practices.
- Run data silo tests. These tests run faster, produce easy-to-diagnose failures, and are more reliable.

## Troubleshooting

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:66.66666666666666%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105723e214">Question</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105723e217">Answer</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Question" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e214 ">Something is wrong with my policy. Where do I start?</td>

            <td data-label="Answer" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e217 ">Use the error message that your policy creates as a starting point. Check the Apex
              Developer Guide for advice on the error category.</td>

          </tr>
          <tr class="">
            <td data-label="Question" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e214 ">My policy shuts down before it executes.</td>

            <td data-label="Answer" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e217 ">Policies don't execute if they take too long to perform all their actions.
              Streamline your policy, and make sure that it's within the metering limit.</td>

          </tr>
          <tr class="">
            <td data-label="Question" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e214 ">I have multiple policies for the same event. What do I do?</td>

            <td data-label="Answer" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e217 ">In general, make only as many policies as you can manage and maintain. There's no
              limit on the number of policies you can create, but not all policies trigger. Policies
              are prioritized, and trigger in this order: block the operation, require multi-factor
              authentication, no action. If you have multiple policies for the same event, not all of
              those policies trigger. For example, let's say you have two policies for one event, but
              one policy blocks the operation and the second is set to require multi-factor
              authentication. The policy that blocks the user executes first and if it triggers, the
              other policy doesn't execute.</td>

          </tr>
          <tr class="">
            <td data-label="Question" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e214 ">My policy isn't working. How do I debug it?</td>

            <td data-label="Answer" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e217 ">
              <p>First, disable the policy and move it to a sandbox. You don't want a broken policy
                to cause problems for your colleagues or customers while you troubleshoot. Then evaluate
                whether the issue is with your policy settings or the Apex code if your policy is
                Apex-based.
              </p>
              <ul>
                <li>If you think your settings are the source of the problem, evaluate the policy's
                  conditions and actions in your sandbox. Adjust the policy's settings, and test for
                  the behaviors you want.</li>

                <li>If you suspect that the problem is with your Apex code, you can debug Apex using
                  the Developer Console and debug logs.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Question" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e214 ">I can't turn off my policy, and it's blocking my users in production. What do I
              do?</td>

            <td data-label="Answer" class="slds-cell-wrap" style="vertical-align:top;" headers="d105723e217 ">Check for known issues documented in Knowledge Articles or Known Issues. These
              resources explain issues that other customers experienced, along with functional
              workarounds. If that doesn't work, contact Salesforce.</td>

          </tr>
        </tbody>
      </table>