We have a base package, 2 extension packages, and we extend 2 other packages. We enhance our packages and deploy to several dev, test, and production customer orgs on a regular basis. We need to provision permissions for Salesforce License Users, Partner Portal "Partner Community" License Users, and a Site User for external facing Web Services in each org. This includes 100's of Visual Force Pages, 100's of Apex Classes, 53 Custom Objects, 5 standard objects, and roughly 1,000 fields that we need to provision FLS permissions for. We need the ability to develop new objects, classes, etc..., and ship permissions with new features. We use major/minor push upgrades for all 3 of our packages.
If we try and ship a consolidated permission set, with permissions for all 5 packages and standard objects, the permissions in the permission set are wiped out on install.
I understand that the current thinking regarding permission sets is that "providing access through an extension may invalidate a permission decision that was made with the base package or standard object. In other words, your permission set could enable delete on an object that is unintended for users of the base package. Ultimately, we need some administrator touch point so that they can make an informed decision whether to allow extension permissions to affect base/standard obj permissions."
The flip side of this would say that you are taking away the admins ability to decide to install a consolidated permission set that has been tested both for functionality and security. This creates a high likelihood that the end result will be less stable, because it won't be a consistent delivery, and less secure, since the permissions that were tested holistically are no longer holistic.
I'm a CEH and CISSP and completely understand the need to have the admin accept / review permission changes. This could be accomplished with a review screen instead of just wiping out the permissions in the permission set on install and behaving like the install of the permission set and assignment to users worked.
Alternatively, does someone have another approach to a large scale scenario like this that has worked?