Profiles versus permission sets
Key Takeaway
Salesforce recommends a minimal profile plus permission sets and permission set groups, so each user gets only the access their tasks require.
A profile holds a user's default settings, such as default record types and page layout assignments. Permission sets add permissions, such as object and field access, without changing the profile.
What profiles and permission sets control
Profiles and permission sets set a user's baseline access. Here is what object, field and user permissions each control:
| Permissions | What they control |
|---|---|
| Object permissions | Whether a user can create, read, edit, or delete records of an object |
| Field permissions | Whether a user can read or edit a field |
| User permissions | Which tasks and features a user can use, such as viewing Setup pages or accessing the API |
Profiles and permission sets do not decide which individual records a user can see. Sharing does that, and it builds on object permissions. Org-wide defaults set the baseline, and then the role hierarchy, sharing rules, and manual sharing open up access. A user needs object permission first, then sharing access to the specific record.