This article describes which options are available to manage permissions for your Booker25 users. As a best practice, it is generally advisable to go for option 3 despite the slightly higher setup time required.
Option 1: Assign the packaged permission sets
The first option is to assign the permission sets included in Booker25 directly to your users. As a consequence, anytime you upgrade Booker25 and there was a change in the permission set, that change is immediately applied to your users. The advantage of this is that permissions on new fields are immediately updated when you upgrade, for example. The disadvantage is that you can’t change any permissions in the permission set. So if there is a permission in the set that you don’t want your users to have, this option would not be suitable.
Can’t modify the packaged permissions
Permissions automatically updated on upgrade Takes almost no time to set up Takes no time to maintain
Option 2: Clone the packaged permission sets
The second option is to clone the Booker25 permission sets and assign these to your users. The advantage is that you have complete control over what permissions are enabled in the cloned set, so you could remove any permission that you don’t want your users to have. The disadvantage is that your cloned permission sets are not updated when Booker25 is upgraded. So if the upgrade includes a new field, you will manually have to include it in all your cloned permission sets.
Can modify permissions in the cloned set Permissions not automatically updated on upgrade
⏲ Takes some time to set up
⏲ Takes some time keep up to date with Booker25 fields
Option 3: Make a permission set group
Using permission set groups, introduced by Salesforce in Spring '20, a third option is now available. This option has all the advantages of the previous options, and none of their disadvantages (except that it does take more time to set up than option 1 does). The general idea is that you create a permission set group which contains at least three permission sets:
A Booker25 permission set
One of your own permission sets that expands on the Booker25 set
A ‘muting’ permission set which disables any unwanted permissions from the Booker25 set
Setting up permission groups is beyond the scope of this article. For more information, see the Salesforce article Create a Permission Set Group.
Can modify permissions in your own set Permissions automatically updated on upgrade
⏲ Takes some time to set up Takes no time to keep up to date with Booker25 fields