In a newly created extension package I noticed that the permission sets included were trying to grant access to base package objects. I was convinced this could not work (these permissions should be ignored) because of previous testing done on this behaviour but after testing the new extension was surprised to find it was now possible. I have raised a Case on the undocumented change in behaviour but would like to understand when this happened.

The most definitive statement I have found so far on the old behaviour is from this answer where a Salesforce PM comments:

I checked with the team. We treat base packaged permissions the same as standard object permissions - they belong to someone else and as a result, providing access through an extension may invalidate a permission decision that was made with the base package or standard object. In other words, your permission set could enable delete on an object that is unintended for users of the base package. Ultimately, we need some administrator touch point so that they can make an informed decision whether to allow extension permissions to affect base/standard obj permissions

The new behaviour makes more sense to me (assuming base and extension are produced by the same publisher) but really I just would like to get this behaviour documented so it can't be changed without notification as has happened this time. The problem is working out when it was changed given permission sets are not explicity versioned and I am going to have to strike lucky to find an old package that might have attempted to do this.

  • Update: The Case I had open on this was closed due to not being able to show the behaviour had changed. As best I can work out the behaviour (old or new) has never been documented. I tried to get both Support and PM responsible to commit to resolving at least the documentation issue but fear it fell on deaf ears despite explaining how important this is for ISVs. Commented Sep 10, 2019 at 18:23


You must log in to answer this question.

Browse other questions tagged .