Permission Set: Existing other OLS/FLS permissions are wiped off in Production

Question

Deployment: We deployed a custom permission set through Copado tool to Production and the git commit for this permission set contains 2 FLS permissions on User object.

The scenario here is - other OLS/FLS permissions on these permission set exists in Production but it was not in sync with git master branch. After merge, I am seeing that PermissionS Set file is newly ADDED to master branch and it contains below FLS.

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <description>Custom perm set to be assigned from v7.x onwards</description>
    <fieldPermissions>
        <editable>false</editable>
        <field>User.CC360_Profile__c</field>
        <readable>true</readable>
    </fieldPermissions>
    <fieldPermissions>
        <editable>false</editable>
        <field>User.DSE__DS_Data_Scout_Profile__c</field>
        <readable>true</readable>
    </fieldPermissions>
    <hasActivationRequired>false</hasActivationRequired>
    <label>CC360 Custom CRUD</label>
</PermissionSet>

Post deployment: we have observed that - it has wiped off other permissions on rest of the objects in Production for the same permission set and contains only above 2 FLS permissions on User object.

Could you please help why the other object permissions are wiped off instead of just appending the User FLS permissions.

As per the Salesforce metadata API behavior - it is stated that "When adding or changing a permission set, you don't need to include all permissions—you only need to include the permissions you're adding or changing." https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_permissionset.htm

Answer 1

PermissionSet returns all permissions on retrieve/deploy (since API 40 and above) and works differently than Profiles. What you're trying to do works with Profiles because it's designed to overlay the existing Profile settings in a target org - meaning, you need to actually include the field with <value>false</value> to remove a field permission and not including it will make no change on the profile.

I would follow up with Copado about PermissionSet behavior if you created it through them and it didn't include all the permissions in it on the commit. PermissionSet, in source control, should contain all permissions and be deployed as such to avoid removals.