I'm new to salesforce and I'm trying to understand the security model for my managed app. The app needs access to custom objects/tabs and field access for some standard objects. The app would be used by a Sales manager like profile in any org and should not be visible to other users. I understand that a system admin can configure assigned apps for any profile.
My question is that If I only give permission to the sys admin profile and let him/her give permissions to the different profiles based on assigned apps. Would that be enough? Will there be any issues in accessing custom objects/pages/fields?
How do other custom apps package permissions and profiles? Do I need a custom profile or permission sets for my app? I do not have experience here, would appreciate any help.
Admins are prompted for who to give access to. You do not need to provide profiles in your package, or give administrators permission on the default profile. However, you should include permission sets so admins can grant access to everything in your package to standard and custom profiles easily. This may be as simple as one default permission set for everything, two permission sets (one for managers, and one for sales people), or as complicated as you need it to be (but not any more complicated than it needs to be).