While the document status automatically updates to "Completed" upon submission, why does this change fail to fire my standard Record-Triggered Flow, and how do we resolve it?
Published on October 3, 2026 DRTE
Why Record-Triggered Flows Fail After E-Signature Submission and How to Fix It with Platform Events
This behavior is caused by Salesforce native guest user security restrictions. When an external recipient completes an e-signature workflow, the submission executes under the Guest User context. Because Salesforce enforces strict security policies that prevent Guest Users from owning records or executing elevated administrative actions, any standard Record-Triggered Flow running in this context lacks the permissions required to update parent CRM records or execute system tasks.
The fix: to bypass these security restrictions and execute your automation under an elevated system context, you must decouple the process using Platform Events. |
Why Standard Record-Triggered Flows Fail
- Guest User Security Model: External signers access the signing portal without logging into Salesforce. All portal actions execute under the site's Guest User Profile.
- Context Inheritance: A standard Record-Triggered Flow executing immediately upon document submission inherits the restricted permissions of the Guest User.
- Permission Denial: When the flow attempts to update restricted records (such as Opportunities, Contracts, or custom objects), Salesforce blocks the transaction due to insufficient guest user privileges.
Symptom: a flow that updates Opportunities, Contracts, or custom objects when a document is signed is blocked because the signer is acting as the Guest User. |
The Solution: Context-Switching via Platform Events
To execute your post-signature logic with full administrative permissions, configure a two-step Platform Event architecture.
Step 1: Create a Record-Triggered Flow (Publishes the Event)
| Flow Setting | Value |
|---|---|
| Object | E Signature Request |
| Trigger | Record is updated |
| Entry Condition | isSigned Equals True (or Status Equals Completed) |
| Execution Path | Move the logic to Async Processing (Scheduled Path) to ensure custom automation does not hinder native e-signature processing. |
| Action | Add a Create Records element to publish a packaged Platform Event record (e.g., ESignatureDocumentRequest). |
Step 2: Create a Platform Event-Triggered Flow (Executes System Logic)
| Flow Setting | Value |
|---|---|
| Triggering Event | ESignatureDocumentRequest (Platform Event) |
| Running User Context | Platform Event-Triggered Flows automatically run under the Automated Process User (System Context), granting full administrative privileges. |
| Actions | Perform your post-signature tasks, such as updating parent record fields, generating Certificates of Completion (CoC), or sending notification emails. |
Result: the first flow only publishes the event. The second flow runs as the Automated Process User, so your post-signature updates are no longer limited by Guest User permissions. |
Knowledge Article Number: KA-00441