Object permissions on profiles and permission sets
Key Takeaway
Profiles, permission sets, and permission set groups can only grant access, never deny it, so a permission set can add access that a user's profile does not give.
Object permissions control what a user can do with the records of each object, such as Accounts or Cases. For example, they decide whether a user can delete Cases at all. They set a user's base-level access through four basic permissions, and they also include the broader View All Records and Modify All Records permissions. You can set them in a user's profile or in permission sets.
Profiles, permission sets, and permission set groups
Every user has exactly one profile but can have many permission sets.
Salesforce recommends using profiles for default settings such as assigned apps, record types, and page layouts. For object permissions, it recommends permission sets and permission set groups. You build access from small, reusable permission sets, so you avoid creating dozens or even hundreds of profiles for each user and job function.
Profiles, permission sets, and permission set groups can only grant access, never deny it. Every grant is honored, so if a profile does not give a permission but an assigned permission set does, the user has it. To revoke a permission, you must remove every instance of it from the user.