Permission set groups and user access policies for persona access at scale
Key Takeaway
Bundle task-based permission sets into a permission set group for each persona, and assign the groups with user access policies. Use a manual policy to move existing users in one pass. Use an active policy for users whose records are created or updated to match its criteria.
A permission set group bundles several permission sets into one unit that matches a user persona, such as an advisor or a teller. A user access policy assigns permission set groups, permission sets, licenses, public groups, and queues to many users at once. Depending on its type, a policy runs when an admin starts it or automatically when user records change. Together, permission set groups and user access policies let a consultant grant persona-based access at scale without building a separate profile for every job.
Profiles and permission sets
Salesforce recommends giving users the "Minimum Access - Salesforce" profile, or a clone of it, and granting permissions through permission sets and permission set groups. Profiles and permission sets then hold different things.
Profiles hold default settings, such as default apps, record types, page layout assignment, login hours, IP ranges, and password policies.
Permission sets hold object, field, user, and custom permissions. Permission sets also hold tab settings, Apex classes, Visualforce pages, and connected app access.