| name | soql-authoring |
| description | Write selective, bulk-safe SOQL that binds its variables and avoids non-selective-query errors on large objects. Use when authoring or fixing a SOQL query, especially against high-volume objects. |
SOQL Authoring
Produce a SOQL query that is selective (index-friendly), bulk-safe, and injection-safe.
When to use
Authoring a new query, fixing a non-selective-query error, or hardening dynamic SOQL.
Steps
- Filter on an indexed field. Prefer Id, Name, audit fields, lookups, external IDs, unique fields, or a custom index. Reject leading-
% wildcards and negative operators on large objects. See knowledge/large-data-volume-design.md.
- Make the filter selective. Confirm the predicate clears the optimizer threshold; add a bounded date/status filter if it doesn't.
- Bind every variable. Use
:var bind syntax — never string-concatenate user input. For dynamic SOQL, bind or String.escapeSingleQuotes. (House opinion #8; escalate injection findings to ravenclaude-core/security-reviewer.)
- Enforce FLS. Add
WITH USER_MODE for user-context queries. At API v67.0+ (Summer '26) WITH SECURITY_ENFORCED is removed and does not compile — use WITH USER_MODE (also supports polymorphic fields and returns the full set of access errors); on older API versions WITH SECURITY_ENFORCED still works. [verify-at-build]
- Stay bulk-safe. Query once with
WHERE Id IN :ids; never put the query in a loop.
- Limit the result. Add
LIMIT and select only the fields you use.
Output
The query, the index it relies on, the bind variables, and a one-line note on selectivity and FLS.
