Winter '27 tightens flow security with an explicit user-context option.
Where
Flow run settings, for autolaunched and screen flows.
How
Enable the setting to execute the flow in the running user's security context. Object and field access follow the user's permissions no matter how the flow is invoked.
Why
Flows that silently run in system context are a classic way to leak data past the sharing model. An enforced user context makes least-privilege the default posture rather than something you bolt on with checks.