Salesforce DictionarySalesforce DictionarySalesforce DictionarySalesforce DictionaryIndividual permission bundle vs collection of bundles
A Permission Set in Salesforce is an additive permission grant that layers on top of a User's Profile. Where a User has exactly one Profile, the same User can have many Permission Sets, each granting a specific capability: access to a custom object, edit rights on a specific field, the ability to run a specific feature, visibility into a particular tab. Permission Sets are how Salesforce's permission model handles "this user is mostly a Sales Rep but also needs to approve discounts" without forcing you to clone the entire Sales Rep Profile into a Sales-Rep-with-Approvals Profile. The Permission Set concept exists because Profile-only permission management does not scale. In an org with twenty Sales Reps who all need almost-the-same permissions plus one of three optional capabilities (Approval Rights, Forecast Adjustments, Mass Email), the Profile-only approach produces three Profiles per capability combination (eight Profiles for three boolean flags, all maintained in parallel). The Permission Set approach is one Profile (Sales Rep) plus three Permission Sets (Approver, Forecast Adjuster, Mass Emailer), assigned in any combination. The maintenance shrinks from updating eight Profiles when a new field ships to updating one Profile plus three Permission Sets. Once you have seen the scaling difference, the Profile-only pattern feels like a relic.
A permission set group is a Salesforce construct that bundles multiple permission sets into a single assignable unit. Users assigned to the group inherit every permission from every permission set in the bundle, without having to be assigned to each one individually. It is the modern way to manage role-based access in Salesforce, replacing the old pattern of stacking many permission sets directly on each user. Permission set groups debuted in 2020 and have become the recommended permission-management pattern for any org of meaningful size. The bundle approach maps naturally to job functions: a Sales Manager group might contain permission sets for Forecasting, Reports, Opportunity Management, and Pipeline Reviews. Assigning one group is cleaner than assigning five permission sets, and the mapping is auditable at a glance. Salesforce has also confirmed that profiles will be retired over time in favor of permission set groups, which makes mastering this pattern foundational rather than optional.
| Dimension | Permission Set | Permission Set Group |
|---|---|---|
| Granularity | Single set of permissions | Combines multiple Permission Sets |
| Assignment | Assigned directly to users | Assigned to users - grants all included sets |
| Management | Manage individual permissions | Manage groups of Permission Sets together |
| Muting | No built-in muting | Supports Muting Permission Sets to revoke specific permissions |
| Use Case | Fine-grained permission grants | Role-based permission bundles for easier assignment |
When granting specific, granular permissions to individual users.
When bundling multiple Permission Sets into role-based packages.
Other side-by-side breakdowns you might find useful