Permission set group
A permission set group bundles several Salesforce permission sets so they can be assigned to users as one unit, usually per job role or persona. A user assigned the group receives the combined permissions of every permission set in it. A muting permission set can switch selected permissions off inside the group.
How a group combines permissions
A permission set can belong to several groups, and a change to it applies to every group that includes it. That is the point of the model: define access once per capability, then assemble capabilities into roles. Salesforce recommends using permission sets and permission set groups to manage user access, keeping profiles for defaults such as page layouts, record types, login hours and IP ranges.
Muting permission sets
Each group can contain at most one muting permission set. It turns off selected object, field, user or other permissions — but only within that group. If the same user receives the permission through a profile, another permission set or another group, they keep it despite the muting.
Salesforce also suggests muting as a way to hold back permissions that arrive with a managed package upgrade until they have been reviewed.
Recalculation and status
Changes to a group are recalculated asynchronously, which can take from seconds to hours; users keep the permissions from the last completed calculation in the meantime. A group reports a status — Updated, Outdated, Updating or Failed — and some operations, such as changing assignments, are not possible while it is not up to date.
Why it matters for audits
Because effective access is the sum of profile, permission sets and groups minus muting within a group, answering "who can edit this field?" means reading all of them together, not one screen at a time.
How aprity helps
aprity documents access from the metadata: profiles, permission sets and field-level security, read-only and in business language. It gives an auditor or an admin one place to read who is granted what on an object, instead of opening each permission set in Setup.
Related terms
- Field-level security (FLS) — The Salesforce setting that decides, per profile or permission set, whether a user can read or edit each field of an object.
- Managed package and namespace prefix — A managed package is a distributable, upgradeable bundle of metadata; its namespace prefix is the identifier added to every component's API name.
Sources
Official Salesforce documentation this entry was checked against. Platform behaviour changes between releases; the linked page is the reference.