Understanding Apex class security
Access to an Apex class can be granted through either a Profile or a Permission Set. For internal users of the platform, it is unlikely that you will ever face major problems with Apex class access, as typically the user is not accessing the Apex class directly but, rather, accessing it via a UI, Process Builder, or Flow, which separates them from direct Apex class access.
This is not the case when exposing classes for use as an API—that is, using the webservice keyword or classes annotated by @RestResource. Similarly, in the Winter ’20 release, Salesforce added a security update that meant Apex methods annotated as @AuraEnabled (that is, accessed through an Aura or Lightning web component) by a portal or guest user must also have permission to the class granted via a Profile or Permission Set. In both situations, the user must be explicitly granted access through the use of a Profile or Permission Set in order to access the class...
