In a newly created extension package I noticed that the permission sets included were trying to grant access to base package objects. I was convinced this could not work (these permissions should be ignored) because of previous testing done on this behaviour but after testing the new extension was surprised to find it was now possible. I have raised a Case on the undocumented change in behaviour but would like to understand when this happened.
The most definitive statement I have found so far on the old behaviour is from this answer where a Salesforce PM comments:
I checked with the team. We treat base packaged permissions the same as standard object permissions - they belong to someone else and as a result, providing access through an extension may invalidate a permission decision that was made with the base package or standard object. In other words, your permission set could enable delete on an object that is unintended for users of the base package. Ultimately, we need some administrator touch point so that they can make an informed decision whether to allow extension permissions to affect base/standard obj permissions
The new behaviour makes more sense to me (assuming base and extension are produced by the same publisher) but really I just would like to get this behaviour documented so it can't be changed without notification as has happened this time. The problem is working out when it was changed given permission sets are not explicity versioned and I am going to have to strike lucky to find an old package that might have attempted to do this.
