Effective access from profiles and permission sets
Key Takeaway
Profiles, permission sets, and permission set groups can only add access, never block it, so to take a permission away, you must find and remove every place that grants it.
A user's effective access is everything granted by their one profile plus every permission set and permission set group assigned to them. A muting permission set gives you a narrow way to switch off selected permissions inside one permission set group.
How effective access adds up
Each user can have only one profile. Depending on the Salesforce edition, a user can also have multiple permission sets. Permission sets extend a user's functional access without changing their profile. You can assign them to users regardless of which profile they have.
Effective access combines all of these sources, including any permission set groups assigned to the user. If a permission is off in the profile but on in a permission set, the user has it.
For example, imagine that the "Manage Password Policies" permission is not enabled in a user's profile, but it is enabled in one of their permission sets. That user can manage password policies.
A user with the "Transfer Record" permission can transfer records whether or not they own them.
Profiles, permission sets, and permission set groups can grant access, but they cannot deny it.
Think of each profile, permission set, and permission set group as a key on a keyring, and think of a door as a permission. Any one key that opens a door is enough. Leaving that key off a different ring does not lock the door.