I'm investigating a platform level behaviour with the standard Location
object and wanted to share my findings to see if anyone else has encountered this.
The Issue
Users with the following object permissions:
- Read = Enabled
- Create = Enabled
- Edit = Disabled
Cannot create Location records. Record creation fails with:
INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY
As soon as we grant Edit
permission on the Location object, the same users can create records successfully.
Troubleshooting Performed
To isolate the problem, we:
- Disabled all Record-Triggered Flows
- Disabled all Apex Triggers (including managed package triggers where possible)
- Attempted creation with only the required Name field populated
- Removed all references to related records and lookup fields
- Verified consistent reproduction across multiple test users
Even under these minimal conditions, Create permission alone is insufficient.
My Hypothesis
While reviewing the Location object documentation, I noticed the
RootLocationId field (Read-only Lookup to Location) is populated with the Id of the Location record itself (self-reference) when a Location has no parent (ParentLocationId is null).
Since a record's Id is not available until the record is saved to database (not committed), any platform process that maintains fields dependent on the newly generated Id must execute in the after context
(context in which the fields of the record itself are no longer editable).
My hypothesis is that Salesforce performs an internal update operation after the insert to populate RootLocationId with the newly created record's Id. If this internal update runs in the same transaction and in the current user context, it would require Edit permission on the Location object—even though the user is only attempting to create a new record.
Why I think this happens:
- RootLocationId is a read-only, system-maintained field
- The field references the Location's own Id (when no parent exists)
- Record Ids are only available in after-insert context
- The error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY typically indicates insufficient permissions on a cross-referenced record
- In this case, the "cross-reference" may be the Location record itself during the internal update
Has anyone experienced the same behavior with the standard Location object? Is there any documented platform behaviour related to RootLocationId or Location hierarchy management that could explain this?
I've opened a case with Salesforce to see if they can provide more information about this behavior. I shared my hypothesis with them.
The log entries related to the transaction that happens when a Location object record is created are very limited. I had already run the test with the ParentLocationId field populated, and the behaviour is the same. According to my hypothesis, that supposed update would be executed regardless of whether the ParentLocationId is populated or not.
I will share any additional information that I get from the support team.