3

Now that we have Permission Sets and Custom Permissions in Salesforce ISVs could package fine-grained permission structures with their applications.

As always with great power comes great responsibility and the risk to misuse it.

Is there already something like a best practise on how to use PermSets and Custom permissions in packaged apps.

Those are my questions (numbered so you can reference them in your answers and comments):

  1. Should I replace Feature toggles in Custom Settings with Custom Permissions ?
  2. Should I have a permission set per User Story or Functional block?
  3. How many Permission Sets is to much?
  4. Use PermSets also to differentiate different roles or user types?
  5. Should PermSets also contain permissions to Base package functionality?
  6. What important other question did I forget?

I would love to hear from you how you have used them with what positive/negative effect.

1 Answer 1

5

Should I replace Feature toggles in Custom Settings with Custom Permissions ?

It depends on the setting. If a user can toggle the feature, it's a preference (custom setting). If it relates to a feature permission, it's probably a custom permission.

Should I have a permission set per User Story or Functional block?

One per feature. For example, a credit card app might want three permissions: debit, credit, and void. Normal sales might only be allowed to debit accounts, while management might be able to credit or void as well.

How many Permission Sets is to much?

Most apps don't need any, but most apps would benefit from a few. If you're over five or so, consider if you really need them. This is kind of opinion based, but remember that too many permission sets will be burdensome to administrators.

Use PermSets also to differentiate different roles or user types?

Each permission set will probably relate to a user's role within the app, and only rarely, if ever, depend on the user's type. I can't think of a good reason you'd use a permission set per user type, but I'm fairly sure someone could come with a compelling argument. There's almost always exceptions to the rule.

Should PermSets also contain permissions to Base package functionality?

In most cases, no. Admins will usually define those permissions on install. Some apps might be restricted to just a limited type of user role to begin with, in which case it may be appropriate.

That's usually more the exception than the rule. Apps that use "site wide licensing" would probably have a use for this, while limited licence apps don't need this; the licence itself provides access to the base app.

What important other question did I forget?

Assuming you know the basics of accessing custom permissions, I'm not sure what else you would need at this point. Also, be due to review the ISVForce guide for limits on upgradablility for permission sets so you understand how they will be affected by versioning.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .