We can add Permission Sets to Connected App's related list.
I want to know how it really works, especially when user has multiple Permission Sets assigned, how it would restrict user when using Connected App.
I had a test, try to block user with Permission Set, here is the step:
・Create 2 Permission Sets(P1, P2) and 1 Profile, all these assign to 1 user.
・P1 has access to Account Object.
・P2 has not access to Account object.
・The Profile has not access to Account object.
・Create 1 Connected App, only relate P2 to it, which has not access to Account.
Then, the user using Connected App to query Account records. Actually I successfully got query result without blocking.
My question is why it didn't blocked the user? If all Permission Sets assigned to the user would take effect, why Connected App need to add a Permission Set? Or I need API Client Whitelisting enable?
Any help would be appreciated.