We need to be able to configure the “Database operations: sharing” rule to do the following:
- Trigger handlers (Classes used in triggers) need to use “without sharing”. Because triggers run without sharing, so a Trigger Handler that uses “with sharing” alters that functionality.
- Batch or Schedule classes can use any sharing, because they are typically ran by a System Administrator and access can be easily controlled.
- Handler and Utility classes (classes with data access) need to use “inherited sharing”, because they should be written to be reused by any type of class.
- Controller classes (classes with auraEnabled methods, are used in VF pages, or expose APIs) need to use “with sharing” because that is the interface with the user.
Right now Controllers and Handlers are in the same group, and Trigger Handlers, Batches, and Schedules are all the same group.