diff --git a/skills/permission-set-skill/SKILL.md b/skills/permission-set-skill/SKILL.md new file mode 100644 index 0000000..0725333 --- /dev/null +++ b/skills/permission-set-skill/SKILL.md @@ -0,0 +1,193 @@ +--- +name: permission-set-skill +description: Generate Salesforce permission set metadata with proper object, field, user, and app permissions. Use when creating access control for users beyond profile settings. +license: Apache-2.0 +compatibility: Salesforce Metadata API v60.0+ +metadata: + author: afv-library + version: "1.0" +--- + +## When to Use This Skill + +Use when you need to generate metadata for a permission set or need to grant additional permissions such as: +- Providing temporary or project-based access +- Enabling feature-specific permissions +- Implementing role-based access control +- Extending profile permissions for specific user groups + +## Step 1: Define Core Properties + +Start by defining the required permission set properties: + +```xml + + YourPermissionSetName + + Clear description of purpose and intended audience + +``` + +**Naming conventions:** +- Use descriptive API names (e.g., `Sales_Manager_Access`) +- Include purpose in description field +- Follow organization's naming standards + +## Step 2: Configure Object Permissions + +Add CRUD permissions for standard and custom objects: + +```xml + + true + true + true + false + false + false + false + Account + +``` + +**Key considerations:** +- Grant minimum necessary permissions (least privilege) +- Use `viewAllRecords`/`modifyAllRecords` sparingly +- Consider record-level security implications + +## Step 3: Set Field-Level Security + +Define field permissions for sensitive or custom fields: + +```xml + + true + true + Account.SSN__c + +``` + +**Important:** +- Cannot set permissions on required fields, they are readable and editable by default +- Use format `ObjectName.FieldName` for field references +- Both `readable` and `editable` can be true (editable implies readable) + +## Step 4: Grant User Permissions + +Add system-level permissions for features and capabilities: + +```xml + + true + ApiEnabled + + + true + RunReports + +``` + +**Common permissions:** +- `ApiEnabled`: API access +- `ViewSetup`: View Setup menu +- `ManageUsers`: User management +- `RunReports`: Report execution + +**Security review required for:** +- `ViewAllData`: Read all records +- `ModifyAllData`: Edit all records +- `ManageUsers`: User administration + +## Step 5: Configure App and Tab Visibility + +Make applications and tabs visible to users: + +```xml + + Sales_Console + true + false + + + CustomTab__c + Visible + +``` + +**Tab visibility options:** +- `Visible`: Always shown +- `Available`: Available but not default +- `Hidden`: Not visible + +## Step 6: Add Apex and Visualforce Access (Optional) + +Grant access to custom code: + +```xml + + CustomController + true + + + CustomPage + true + +``` + +## Step 7: Configure Custom Permissions (Optional) + +Enable custom permissions for feature flags: + +```xml + + true + Can_Approve_Discounts + +``` + +## Step 8: Set License and Record Type Settings (Optional) + +Specify license requirements and record type visibility: + +```xml +Salesforce +false + + Account.Business + true + true + +``` + +## Validation Checklist + +Before deploying, verify: +- [ ] All required fields (fullName, label, description) are set +- [ ] Object permissions follow least privilege principle +- [ ] No field permissions on required fields +- [ ] System permissions (ViewAllData, ModifyAllData) are reviewed +- [ ] No duplicate permissions across multiple permission sets +- [ ] Description clearly states intended use case +- [ ] Naming follows organizational conventions + +## Deployment + +Deploy using Salesforce CLI: +```bash +sf project deploy start --metadata-dir force-app/main/default/permissionsets +``` + +Verify deployment: +- Check permission set appears in Setup > Permission Sets +- Assign to test user and validate access +- Review audit trail for assignment tracking + +## Best Practices + +- **Granularity**: Create focused permission sets for specific purposes +- **Documentation**: Maintain clear descriptions and naming +- **Auditing**: Regularly review assignments and usage +- **Testing**: Always test with dedicated test users before production +- **Groups**: Use permission set groups for complex access patterns +- **Security**: Never grant excessive permissions like ModifyAllData without justification +