I have to create a permission set for a user, where only when the Lead source is web, he/she should be able to view and edit that set of records. Is this achievable by using permission set?
Permission sets and profiles work in an identical fashion in that you can use them to configure Create/Read/Edit/Delete access to an entity, or to the fields in that entity.
But these features cannot be used to identify which users can access individual records of a given entity, except in two ways.
- You can use a permission set or profile so that members can access every record for a given entity in a read-only fashion by using the "View All" checkbox.
- You can use a permission set or profile so that members have full access to every record for a given entity by using the "Modify All" checkbox.
What you cannot do with permission sets or profiles is grant access to a specific subset of records.
In order to do so, you need to use the rules for record-level access which is controlled by the sharing model.
Fortunately there are excellent whitepapers to help newcomers understand the functioning of the sharing model. There is one on the basic sharing architecture. There is another that gives a more under-the-hood view of what goes on when sharing happens.
There is also the security workbook, with hands-on exercises to you can build some test cases and understand how security works in the context of entity, field, and record access.
Full Record Access: To understand what I'm talking about above by "full access" and how that is distinguished from assigning all of the Create/Read/Edit/Delete access perms on an entity, you should read the Sharing Model whitepaper above and do the workbook. But I always remember this using the mnemonic: VESTeD. When you have full access, you are VESTeD meaning you have:
- View access to a given record
- Edit access to a given record
- Share access to a given record (you are permitted to manually share this record with other users who don't automatically have access).
- Transfer Access to a given record (transfer ownership of this record to another user).
- Delete access to a given record (normally, only owners and some other privileged users can delete records).