The development team missed two features that are causing the problems:

The With Sharing keyword in Apex classes to enforce sharing rules evaluation. This keyword allows

the Apex class to run in the context of the current user and respect the organization’s sharing rules.

Without this keyword, the Apex class runs in system mode and ignores the sharing rules, which can

result in unauthorized access to records that belong to other users .

The isAccessible() method in Apex classes to check field accessibility. This method returns true if the

current user has read access to the specified field, and false otherwise. Without this method, the

Apex class does not check the field-level security settings and can display fields that should be hidden

from the user, such as the shipment amount .

Reference:

: Using the with sharing or without sharing Keywords

: Enforcing Sharing Rules in Apex

: Schema.DescribeFieldResult Class

: Enforcing CRUD and FLS