Persona-based permission sets and field-level security for sensitive client fields
Key Takeaway
Give profiles no access to sensitive client fields. Then grant Read and Edit or Read through a custom permission set for each persona that needs the field. Users without a grant can't see the field anywhere in the app.
Agentforce Financial Services controls who sees what by matching each user persona, such as Advisor, Personal Banker or Teller, to a profile and a set of permission sets. Field-level security then decides, field by field, whether a user can edit a field, only read it, or not see it at all. Together, they limit sensitive client data to the people who need it.
Profiles and permission sets
Salesforce controls access in layers. Profiles set each user's default settings and page layouts. Permission sets and permission set groups then grant object, user and field permissions on top of the profile.
Salesforce recommends managing permissions with permission sets and permission set groups. Small permission sets work as reusable building blocks, so you avoid creating dozens or even hundreds of profiles for each user and job function.