Hello,

I have a custom VF page and controller. The controller is declared as 

public with sharing class MyCustomController {

The user accessing this page is a Partner user and does not have "Edit" Permissions on Leads but is still able to assign leads to other users.

I also tried assigning leads to a user who does not have "Read" permission on leads and that also surprising worked.

As per my understanding if I declare the class with the "with sharing" keyword, it should take into account the user permission.

Can someone explain why the "with sharing" is not having any effect.

Thanks,

Rohit