Does field-level security apply to SOQL and the API?

Yes for standard user contexts and for Apex running in user mode. Apex running in system mode ignores FLS unless it uses user-mode database operations or explicit permission checks.

Why is a field visible in a report but not on the record page?

The page layout does not include it. Reports and list views expose any field the user has FLS Read on, regardless of layout.

Can permission sets remove field access?

Not on their own - permission sets are additive. Only permission set groups with muting can subtract a permission granted elsewhere in the group.

How to Check Field-Level Security in Salesforce Fast

Check field-level security in Salesforce without clicking through Setup: where FLS lives, how it interacts with profiles and permission sets, and faster ways to read it.

Updated 2026-09-09

"The field is blank for me but not for you" is almost always field-level security. Confirming it in Setup means navigating to the object, the field, and then the profile list - per field, per profile.

This page covers where FLS actually lives, what overrides it, and how to shorten the check.

Where field-level security is set

Setup → Object Manager → the object → Fields & Relationships → the field → Set Field-Level Security.
Setup → Profiles → the profile → Field-Level Security, per object.
Setup → Permission Sets → the permission set → Object Settings, which can grant access the profile denies.

What overrides what

Effective field access is the most permissive combination of the profile and every assigned permission set. A field hidden on the profile is still visible if any assigned permission set grants Read.

Page layouts are a separate layer: a field removed from the layout is invisible in the UI even when FLS grants access, but it is still returned by the API and by SOQL.

Reading it inline instead

TurboKit's profile reader shows field-level permissions for the object you are looking at, in the page you are already on. For a permission ticket, that is the difference between a two-minute answer and a ten-minute navigation.

Diagnostic order for an invisible field

Is the field on the user's page layout for that record type?
Does FLS grant Read on the profile or any assigned permission set?
Does the user have access to the record at all - sharing, not field security?
Is the field's value genuinely blank for that record?

Frequently asked questions

Does field-level security apply to SOQL and the API?: Yes for standard user contexts and for Apex running in user mode. Apex running in system mode ignores FLS unless it uses user-mode database operations or explicit permission checks.
Why is a field visible in a report but not on the record page?: The page layout does not include it. Reports and list views expose any field the user has FLS Read on, regardless of layout.
Can permission sets remove field access?: Not on their own - permission sets are additive. Only permission set groups with muting can subtract a permission granted elsewhere in the group.