Basket Validation or Save Fails Due to Insufficient Access on Cross-Reference Attribute

Problem

When attempting to validate or save a basket in the Solution Console, the operation fails with an error similar to:

Delegate function storeConfiguration failed:
Delegate experienced an error: Failed to successfully persist the configuration

Upon further investigation of the logs, the underlying error is:

System.DmlException: Upsert failed. First exception on row 0; first error: 
INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: a5P5m000000099l

This error indicates that an attribute in the basket is referencing a Salesforce record that either:
- Has been deleted
- Is inaccessible due to sharing rules or permissions
- No longer exists in the system

Root Cause

The basket contains one or more attributes configured with a Lookup data type (e.g., Lookup to Account, Billing Account, Contact, etc.) that store Salesforce record IDs as their values.

When the basket is saved or validated, CloudSense attempts to upsert (insert or update) related records and validate the integrity of all lookup references. If any attribute value points to a record ID that:
1. No longer exists (deleted or purged)
2. Is not accessible to the current user due to sharing rules
3. Has been archived or moved to a different object

Salesforce throws the INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY error, preventing the save operation from completing.

Common attributes that may cause this issue:
- BillingAccountLookup (references csconta__Billing_Account__c)
- BillingAccountShadow (references csconta__Billing_Account__c)
- AccountLookup (references Account)
- ContactLookup (references Contact)
- Any custom lookup attribute configured in your Solution Definition

Resolution Steps

Step 1: Identify the Problematic Record ID

1. Review the error message to extract the cross-reference ID:
   insufficient access rights on cross-reference id: a5P5m000000099l

2. Note the record ID (e.g., a5P5m000000099l)

3. Determine the object type from the record ID prefix:

4. a5P typically corresponds to csconta__Billing_Account__c
5. 001 corresponds to Account
6. 003 corresponds to Contact
7. Use Salesforce Setup > Object Manager to verify the prefix if unsure

Step 2: Verify Record Existence and Accessibility

1. Attempt to access the record directly in Salesforce:
2. Navigate to the record URL: https://your-instance.salesforce.com/a5P5m000000099l
3. If the record does not exist, you will see: "The page you requested does not exist"

4. If the record exists but is inaccessible, you will see: "Insufficient Privileges"

5. Check if the record has been deleted:

6. Go to Setup > Recycle Bin
7. Search for the record ID a5P5m000000099l

8. If found, note whether it can be restored or is permanently deleted

9. Check sharing rules and permissions:

10. If the record exists but is inaccessible, verify that your user profile or role has appropriate access to the object and record
11. Review Organization-Wide Defaults (OWD) and sharing rules for the object

Step 3: Identify Which Attribute Contains the Problematic Value

1. Open the basket in the Solution Console

2. Use the browser console to inspect attribute values:

await CS.SM.getActiveSolution().then(solution => {
  const configs = solution.getConfigurations();
  configs.forEach(config => {
    const attrs = config.getAttributes();
    Object.keys(attrs).forEach(attrName => {
      const attrValue = attrs[attrName].value;
      if (attrValue === 'a5P5m000000099l') {
        console.log(`Found in Configuration: ${config.name} (${config.guid})`);
        console.log(`Attribute: ${attrName}, Value: ${attrValue}`);
      }
    });
  });
});

1. Alternatively, query the Solution Management database (if you have access):
2. Use the correlation ID or basket ID to locate the configuration data

3. Search for the problematic record ID in the attribute values

4. Common attributes to check:

5. BillingAccountLookup
6. BillingAccountShadow
7. AccountLookup
8. ContactLookup
9. Any custom lookup attributes

Step 4: Correct the Attribute Value

Once you've identified the attribute containing the problematic value:

Option A: Update to a Valid Record ID

1. In the Solution Console, navigate to the configuration containing the attribute
2. Locate the attribute field (e.g., Billing Account Lookup)
3. Clear the current value or select a valid, accessible record
4. Save the configuration
5. Retry the basket validation/save operation

Option B: Clear the Attribute Value (If Not Required)

1. In the Solution Console, navigate to the configuration
2. Locate the attribute field
3. Clear the value (leave it empty)
4. Save the configuration
5. Retry the basket validation/save operation

Option C: Restore the Deleted Record (If Available in Recycle Bin)

1. Go to Setup > Recycle Bin
2. Search for the record ID a5P5m000000099l
3. Select the record and click "Undelete"
4. Return to the Solution Console and retry the basket validation/save operation

Step 5: Verify the Fix

1. Click "Validate" or "Save" in the Solution Console
2. Verify that the operation completes successfully without the cross-reference error
3. Check the job status to ensure configuration persistence succeeded

Prevention

To prevent this issue in future baskets:

• Implement validation rules on lookup attributes to ensure referenced records exist before basket submission
• Avoid deleting records that are referenced in active baskets or solutions
• Use soft-delete patterns (e.g., mark records as inactive) instead of hard-deleting them
• Regularly audit lookup attribute values in baskets to identify orphaned references
• Document record deletion procedures to include checks for active basket references

Important Notes

• This error can occur with any lookup attribute that references a Salesforce record
• The error message provides the specific record ID that is causing the issue, making diagnosis straightforward
• If multiple attributes contain invalid references, you may need to correct each one individually
• Sharing rules and permissions can also cause this error even if the record exists
• If the attribute is required and the record cannot be restored, you must select a different valid record