Salesforce Permission Sets

Think of a building with many doors. Every employee receives a basic badge that opens the main entrance. Some employees need extra access to the server room or the finance office. Instead of printing a new badge for each person, the security team adds small access stickers. Salesforce Permission Sets work like those stickers. They add specific permissions on top of a user's profile.

Profiles and Permission Sets Compared

Every user holds exactly one profile. The profile sets the baseline: which objects the user opens, which apps appear, and which login hours apply. Permission sets extend the baseline. A user can hold many permission sets at the same time.

Feature	Profile	Permission Set
Assigned per user	Exactly one	Zero, one, or many
Purpose	Baseline access	Extra access for a task or role
Can remove access	Yes	No, only adds access
Reuse across teams	Limited	High

The Layered Access Model

+------------------------------------------+
|  Permission Set: Export Reports          |
+------------------------------------------+
|  Permission Set: Edit Opportunities      |
+------------------------------------------+
|  Profile: Standard User (baseline)       |
+------------------------------------------+
          Final access = all layers combined

Salesforce combines the profile with every assigned permission set. The most generous setting wins when two layers disagree. A user who cannot delete accounts under the profile gains that ability when a permission set grants it.

What a Permission Set Can Grant

• Object permissions: Read, Create, Edit, Delete, View All, Modify All.
• Field permissions: Read and Edit access to individual fields.
• System permissions: Export Reports, Manage Users, Run Flows, API Enabled.
• App and tab visibility.
• Apex class and Visualforce page access.
• Custom permissions that Flows and code can check.

Create a Permission Set: Step by Step

1. Open Setup and search for Permission Sets.
2. Click New and enter a label such as Export Reports.
3. Leave the licence field empty to allow any user, or pick a licence to limit the audience.
4. Save, and open System Permissions.
5. Click Edit and tick Export Reports.
6. Save the change.
7. Click Manage Assignments and add the users who need the access.

Permission Set Groups

A busy org collects dozens of permission sets. A Permission Set Group bundles several sets into one package that admins assign in a single step. A Sales Manager group might include Edit Opportunities, Export Reports, and Approve Discounts. A new manager receives the group, and every permission arrives together.

Permission Set Group: Sales Manager
        |
        +-- Edit Opportunities
        +-- Export Reports
        +-- Approve Discounts
        |
Assigned to: Anita, Karan, Joseph

Editing the group updates every assigned user at once. The admin avoids repeating the same change across many accounts.

Muting Permission Sets

A group can include a muting permission set. Muting removes selected permissions from the group without touching the original sets. A trainer who needs the Sales Manager bundle but should not export reports receives the group with a mute on the export permission.

Example Scenario: Temporary Project Access

A marketing analyst needs to edit Campaign records for one quarter. The admin builds a permission set called Campaign Editor and assigns it to the analyst. The profile stays untouched. At the end of the quarter, the admin removes the assignment, and the extra access disappears. Profile changes would affect every user on that profile, which creates risk.

Principle of Least Privilege

Security teams recommend giving users the minimum access that their job requires. Salesforce supports this approach through a lean profile plus focused permission sets. Each set describes one job function, so audits become simple. A reviewer reads a short list of sets per user and understands the access immediately.

Best Practices

• Name sets after tasks, such as Approve Discounts, rather than people.
• Write a description for every set so future admins know the intent.
• Group related sets into Permission Set Groups for each job role.
• Review assignments each quarter and remove access that nobody uses.
• Test changes in a sandbox before releasing to production.