Extending integration user access with permission set licenses and permission sets
Key Takeaway
An integration user on the Salesforce Integration user license starts with API-only, minimum access. To extend it, assign the Salesforce API Integration permission set license. Then assign a permission set that grants only the object permissions and field access the integration needs.
An integration user is a dedicated Salesforce user that an outside system, such as a core banking system, uses to read and write data through the API. The Salesforce Integration user license gives this user a locked-down, API-only starting point. You widen its access by adding permission set licenses and permission sets. In Agentforce Financial Services, this lets an integration user load data into Financial Account and related standard objects without extra Agentforce Financial Services licenses.
One integration user per integration
Salesforce recommends one integration user for every integration, following the principle of least privilege. Assign a different user to each calling system, domain, use case, or API resource. Each user is then limited to its own subset of data and functionality. You get more control over operations, and you can trace each transaction back to one integration. If one user or integration is compromised, the impact is smaller because that user reaches only its own subset.
Orgs in supported editions get a limited number of Salesforce Integration user licenses by default. You buy add-on licenses through a Salesforce account executive. Because each integration gets its own user, the number of integrations in your design affects how many licenses the project needs.