Explain when without sharing is justified and how to audit elevated access

• without sharing only for system operations: rollups, sharing calc, integration enrichment • Document justification per class in security registry • Narrow elevated logic into single service class not entire controller • Never without sharing on @AuraEnabled user-facing entry points without review • Audit log elevated access operations with business justification code • Quarterly review of without sharing classes against active use cases • Prefer manual share creation over blanket without sharing visibility