A plug-in class stores the current account's name in a private instance field during Execute and reads it later in the same method. Under load, the plug-in occasionally writes one user's account name onto another user's record. What is the cause, and how should the developer fix it?

Dataverse may cache a plug-in instance and call its Execute method from multiple threads concurrently for different requests. Any value stored in an instance or static field can therefore be overwritten by another execution between the time it is written and read, which explains one user's account name appearing on another user's record under load. Plug-ins must be stateless: values derived from the request belong in local variables within Execute, and anything request-specific should be read from the execution context passed to that call. Constructor configuration that is read-only and identical for every execution is safe to keep in fields. The claim that each instance runs once and is disposed is the opposite of actual behavior, and a static field would make the leak worse by sharing the value across all instances. The execution context is created per request and is not shared across users, so locking it addresses a problem that does not exist and would serialize execution needlessly. Plug-in instances are not serialized between stages; each step's execution receives its own context, so marking a field serializable changes nothing. Exam caveat: the solution checker flags plug-ins that set member variables in Execute. Operational check: refactor the field to a local variable, run concurrent saves in a load test, and confirm that every record receives its own account name.