--- schema_version: "1" id: c5e83dcf744fb0da4b10a957c280877e3c846c08e223e3f5053ee241bc393a44 title: Security for Omnistudio Data Mappers and Integration Procedures (Managed Package) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/os_security_for_dataraptors_and_integration_procedures.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 4f3ca1d64c74d8faa7dc92cf87b04d0b6420ad966180f91ef5b622f33e7b42cb description: For the managed package runtime, you can control access to Data Mappers and Integration Procedures using settings that reference Sharing Settings and Sharing Sets or Profiles and Permission Sets. products: - Omnistudio release: "264" --- # Security for Omnistudio Data Mappers and Integration Procedures (Managed Package) For the managed package runtime, you can control access to Data Mappers and Integration Procedures using settings that reference Sharing Settings and Sharing Sets or Profiles and Permission Sets. ![Managed Package app icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/resources-global/_corporate/images/managedpackageicon.png) This information is for Omnistudio for Managed Packages. For Omnistudio on standard runtime, see [Omnistudio Help](https://help.salesforce.com/s/articleView?id=xcloud.os_omnistudio_standard.htm&language=en_US). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important Beginning with the Winter '20 Salesforce release, [Guest Users](https://help.salesforce.com/articleView?id=networks_public_access.htm&language=en_US), also called anonymous users, cannot access any records by default. Criteria-based Sharing Rules grant them read-only access. This affects all Salesforce orgs. For details, see [Guest User Record Access Development Best Practices](https://www.learnexperiencecloud.com/s/article/Guest-User-Record-Access-Development-Best-Practices). Vlocity allows guest users to create and update the records to which [Sharing Rules](https://help.salesforce.com/articleView?id=xcloud.security_about_sharing_rules.htm&type=5&language=en_US) grant access. No additional configuration is necessary for this expanded access. Prior to the Summer '19 release, you might have used Salesforce [Sharing Settings](https://help.salesforce.com/articleView?id=managing_the_sharing_model.htm&type=0&language=en_US) to secure access to Data Mappers and Integration Procedures. This approach is still supported. If you use [caching](https://help.salesforce.com/s/articleView?id=xcloud.os_cache_for_dataraptors_and_integration_procedures.htm&release=264.0.0&type=5 "For the managed package runtime, Omnistudio offers multiple caching options to improve performance and minimize unnecessary data processing in Data Mappers. The two primary user-configurable caching types are Org Cache and Session Cache, which are available in the Data Mapper designer. These caching mechanisms are part of the Salesforce Platform Cache and are implemented through Vlocity Cache in Omnistudio with managed package runtime. Each serves a distinct purpose and comes with specific configuration considerations."), you must set CheckCachedMetadataRecordSecurity to true as described here. Beginning with Summer '19, you can allow access to a Data Mapper or Integration Procedure based on the Custom Permissions enabled in a user's Salesforce [Profiles](https://help.salesforce.com/articleView?id=admin_userprofiles.htm&type=0&language=en_US) or [Permission Sets](https://help.salesforce.com/articleView?id=perm_sets_overview.htm&type=0&language=en_US). An Apex class added to your Salesforce Org allows the Vlocity Managed Package to check user Custom Permissions. The custom settings described here are related to this approach. Vlocity recommends using Custom Permissions in Profiles or Permission Sets for ease of use and better performance. For Salesforce access basics, see [Control Who Sees What](https://help.salesforce.com/articleView?id=security_data_access.htm&type=0&language=en_US), [Who Sees What — Overview Video](http://salesforce.vidyard.com/watch/kXk6BaNlWJP27UyFO8vNUg), and [Salesforce Data Security Model — Explained Visually](https://developer.salesforce.com/blogs/developer-relations/2017/04/salesforce-data-security-model-explained-visually). For Vlocity-specific information about Profiles, see Overview of Profiles and Security for Vlocity. Sharing Settings, Sharing Sets, Profiles, and Permission Sets control access to Data Mappers and Integration Procedures as object records. To ensure field-level security for a Data Mapper, go to the Data Mapper’s Options tab and select **Check Field Level Security**. To automatically enforce field-level security for all Data Mappers, enable EnforceDMFLSAndDataEncryption in the Omni Interaction Configuration. To ensure that the classic encrypted fields are shown in plain text only if the user has the View Encrypted Data permission, enable EnforceDMFLSAndDataEncryption in the Omni Interaction Configuration. To enable EnforceDMFLSAndDataEncryption in the Omni Interaction Configuration, follow these steps: From Setup, search and open Omni Interaction Configuration. Click **New Omni Interaction Configuration**, enter EnforceDMFLSAndDataEncryption for both name and label, set the value to true, and save your changes. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important During the week of February 2, 2026, Salesforce enables the AdvancedOmnistudioAccessCheck, ApexClassCheckForIP, ApexClassCheck, EnforceDMFLSAndDataEncryption, and EnableQueryWithFLS settings by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions. See [Advanced Security Checks for Omnistudio for Managed Packages](https://help.salesforce.com/s/articleView?id=xcloud.os_advanced_security_updates_overview.htm&release=264.0.0&type=5 "Advanced security checks for Omnistudio for Managed Packages enhance data protection by enforcing stricter validation of access and permissions. When enabled, these checks validate object-level access, field-level security, and Apex class permissions for all users, including guest, authenticated, and non-authenticated users, across Omnistudio components."). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important A user's access to a Data Mapper or Integration Procedure includes more than the ability to run it directly. Access also applies if an application the user is using [calls](https://help.salesforce.com/s/articleView?id=xcloud.os_integration_procedure_invocation.htm&release=264.0.0&type=5 "For the managed package runtime, you can invoke Integration Procedures from other Omnistudio tools such as Omniscripts and Cards. You can also invoke Integration Procedures from Apex classes, batch jobs, REST APIs, or Salesforce flows.") the Data Mapper or Integration Procedure. If a user has access to a parent Integration Procedure, the parent can invoke child Integration Procedures and Data Mappers to which the user doesn’t have direct access. - **[Configure Omnistudio Data Mapper and Integration Procedure Security Settings (Omnistudio for Managed Packages) (Managed Package)](https://help.salesforce.com/s/articleView?id=xcloud.os_configure_dataraptor_and_integration_procedure_security_settingsvlocity.htm&release=264.0.0&type=5)** For the managed package runtime, you can change settings for Data Mapper and Integration Procedure security in Setup. - **[Omnistudio Data Mapper and Integration Procedure Security Settings (Managed Package)](https://help.salesforce.com/s/articleView?id=xcloud.os_dataraptor_and_integration_procedure_security_settings.htm&release=264.0.0&type=5)** For the managed package runtime, these settings affect Data Mapper and Integration Procedure security. - **[Implement the VlocityRequiredPermissionCheck Class (Managed Package)](https://help.salesforce.com/s/articleView?id=xcloud.os_implement_the_vlocityrequiredpermissioncheck_class.htm&release=264.0.0&type=5)** For the managed package runtime, for the DefaultRequiredPermission setting to work, you must implement the VlocityRequiredPermissionCheck class manually because Salesforce handles classes in managed and unmanaged packages differently. This class doesn't work properly if it's included in the managed package.