Permission set groups for persona access
Key Takeaway
Build permission sets around tasks and bundle them into permission set groups that match personas. When a permission set is in more than one group and one group should lose a permission, mute that permission in the group instead of editing the permission set.
A permission set group bundles several permission sets into one unit that matches a user persona or job function, such as Sales Staff Users. Users assigned the group get the combined permissions of all the permission sets in it. Groups make access easier to manage when several personas need overlapping permissions.
The recommended access model
The recommended access model has three layers:
| Layer | What it does | How to use it |
|---|---|---|
| Profile | Provides default settings. Each user has only one profile. | When possible, give users the Minimum Access - Salesforce profile or a clone of it. |
| Permission sets | Allow additional tasks that the profile does not enable. | Build them around tasks. |
| Permission set groups | Package the task-based permission sets by job function. | Bundle permission sets into groups that match user personas. |
You can assign multiple permission set groups to a user with more than one persona.
Salesforce recommends assigning permission set groups instead of many individual permission sets, especially for large numbers of users, because assigning the same multiple permission sets to many users can cause issues.