We created a Salesforce visualforce page with a controller that uses without sharing. However, the fields only show as read only on the visualforce page for the users. Salesforce says you must give them access to customize applications which also gives them access to setup and configuration. We do not want the users to have access to setup and configuration. Looking for a workaround.