Session-based permission sets for temporary access
Key Takeaway
Assigning a session-based permission set is not enough by itself. The user must also activate it in their current session, and the access ends when that session ends.
A session-based permission set is a permission set whose permissions work only during a user session in which it has been activated. Admins use one to give temporary or conditional access. For example, a user might reach sensitive records only after running a flow or signing in with a token. When the session ends, the access ends too.
Assignment and activation
You create a session-based permission set almost exactly like any other permission set. The one difference is that you select "Session Activation Required", which tells Salesforce that the permission set becomes enabled only with an activated session.
Unlike with a regular permission set, assigning a session-based permission set grants nothing on its own. The user gets its permissions when two things are true: the permission set is assigned to them, and it is activated in their current session.
Activation fails if the user is not already assigned to the permission set. The error states that the permission set must be pre-assigned before it can be activated.