Reviewing effective user access
Key Takeaway
Effective access has two separate checks. To see why a user can reach a record, open the record's "Sharing Hierarchy" and click "View" for the user. To see which profile, permission set, or permission set group grants the object access, use "Access Granted By" in the user's "View Summary".
A user's real access in Salesforce comes from several layers at once: one profile, any permission sets and permission set groups, and the sharing features that open up individual records. Salesforce gives admins summary pages and analysis tools that pull these layers into one view. With them, you can see what a user can do and which assignment grants it. Reviewing effective access is the starting point when a user has too little access or more access than intended.
Where a user's permissions come from
Permissions reach a user through one profile, any number of permission sets, and any number of permission set groups. A permission set group gives its users every permission in the permission sets it includes. Because of these layers, the same permission can reach a user by more than one path. For example, a user might get the same object permission from their profile and from a permission set inside a permission set group.