Permission Set Group
Permission set groups bundle multiple permission sets into one assignable unit, but their combined access recalculates asynchronously, not instantly.
Definition
A permission set group lets an admin assign several permission sets to a user as a single unit instead of assigning each one individually, and supports muting permission sets that explicitly remove specific access a member set would otherwise grant. Salesforce recalculates a group's combined permissions asynchronously whenever a member permission set, the group's assignment, or a muting permission set changes, so there can be a short lag, typically seconds, between a metadata deployment and a user's access actually updating. If a permission set that belongs to a group fails to deploy or gets deleted, the group's status can flip to “updating” and leave members with a stale permission snapshot until the recalculation finishes. Teams that deploy permission set groups without accounting for that lag sometimes see support tickets from users whose access “didn't take” right after a release. Our security review checklist covers access control as part of a broader review.
How it works in Serpent
Serpent tracks permission set and permission set group metadata like any other component, included in preflight checks and org comparison so drift between sandboxes and production is visible before it reaches a user. See org management in Serpent for how permission drift is surfaced.
Start free. No credit card, no install, no commitment.
Set up in under 15 minutes. No DevOps hire needed.