Permission set groups for job functions
Key Takeaway
Bundle small, task-based permission sets into one permission set group per persona. If only one persona must lose a permission that a shared permission set grants, mute it in that persona's group instead of editing the shared permission set.
A permission set group bundles several permission sets into one unit that matches a job persona, role, or job function, such as Sales Staff Users. Users assigned the group get the combined permissions of every permission set in it. You assign one group per persona instead of tracking many separate permission set assignments or cloning many profiles.
Permission sets for tasks, groups for personas
Permission sets and groups work at different levels. Build each permission set around a task, not a job title. Include all the permissions that task needs, but keep the permission set limited to a few related tasks. Then bundle those permission sets into groups that match your user personas.
The same permission set can be in more than one group. You can also still assign it on its own, outside any group. When different personas do some of the same tasks, reuse the shared permission set in each persona's group instead of building a new one.
A group fits people who share a job function even when their titles differ. A new hire or contractor who needs the same access just gets the same group. A user with more than one persona can be assigned multiple groups.
Your company runs a yearly vendor audit. An Operations Analyst, a Procurement Lead and a Finance Controller all review audit records, so you create one Vendor Audit group for all three. A contractor named Priya joins to help with the audit. You assign her the Vendor Audit group, and she gets the same access as the others. The Finance Controller also plans budgets, so she is assigned both the Vendor Audit group and a Budget Planning group.