What it requires. Flows must not run in System Context Without Sharing unless the elevation is deliberate, documented, and justified. The run mode must be the default running-user context or, where system access is genuinely required, System Context With Sharing with minimum permissions.
Why it matters. A flow in System Context Without Sharing reads and writes all records, ignoring sharing rules entirely. For screen flows and any flow reachable by portal or guest users, this exposes data the running user could never otherwise see. The Well-Architected framework's stated pattern is the most restrictive execution context possible; its named anti-pattern is running in system mode regardless of what the flow performs.
How to fix it. Set the flow's run mode to the default running-user context. Where elevated access is genuinely required, prefer System Context With Sharing, grant the minimum object and field permissions the flow needs, and record the justification in the flow description. From Winter '27 there is a direct fix: select "User Context—Enforces User Permissions" in the How to Run the Flow menu of an autolaunched or screen flow. The flow then runs in the running user's context regardless of how it is invoked, so it can only read and change what that user could. Prefer this to justifying an elevation.
Is this rule worth checking?
Votes and comments are published here. We read them, and we publish what we change with the reasoning — a vote does not move a rule on its own.