I have hundreds of different functionalities setup in Salesforce each with its own Permissions Set for various privleges (FLS, Class access etc), given to various roles across the business. I wish to have only a few simple Department based Profiles and to provide Permissions using Permission Sets and Permission Set Groups, and not via Profiles.
Requirements:
- I do not want many permissions in the System Admin Profile.
- I want all of the permissions from all of the other department's features to be available to System Admin, as multiple PSets or PSetGroups.
- I prefer not to have to configure a System Admin Permission Set each time a new Feature is configured for a department.
- I want to be able to give system admin access via a Permission Set Group all of the Permission Sets.
- New Features get a new PSet, and get added to the PSetGroups of the various Departments or Users Business Role.
Questions:
If a person with System Admin Permission Group has these hundreds of Permission Sets within their Permission Set Group will that lower the performance of the user? Also is there a limit to the number of Permission Sets or Groups allowed per user?
Also to ask it another way, are permission Sets Calculated at config time or at login time or run time, at what stage are permission sets calculated to help understand the performance impact the user would experience, and the underlying architecture would also help.