📖 Read · 20 XP
Profiles vs permission sets
Profiles vs permission sets
These control what users can do: object permissions (CRUD), field permissions, app access and system permissions like "API Enabled" or "Modify All Data".
Profiles
- Every user has exactly one profile
- Defines the baseline: login hours, IP ranges, default apps, page layout assignments
- Historically held all permissions, which led to dozens of near-identical cloned profiles
Permission sets
- A user can have many permission sets
- They only add access (they can't take it away)
- Use them for anything beyond the baseline: "Can delete Leads", "Apex Quest Admin", "API access"
Permission set groups
Bundle permission sets into a persona, like "Sales Manager" = Sales Rep + Reports Power User + Forecasting. Assign the group, not ten individual sets.
The modern model
Salesforce's guidance is now:
- Keep profiles minimal (often just one or two per user license)
- Grant access with permission sets and permission set groups
Object permissions: CRUD + View All / Modify All
| Permission | Grants |
|---|---|
| Read, Create, Edit, Delete | Basic object access, still subject to sharing |
| View All | See every record of that object, ignoring sharing |
| Modify All | Edit/delete every record, ignoring sharing |
🦝 Profiles tell you who you are. Permission sets tell you what else you're allowed to do. Quill has both, and also a mask.