Ursa Major Solar utilizes accounts in its sales process; however, not all users have access to them. New users require read access to accounts. Additionally, four new users require edit access. What…

While a profile can grant view access and a permission set edit, setting the Organizational-Wide Defaults to Public Read Only for Accounts and then using permission sets for specific edits is often a more scalable best practice.

The most flexible approach for managing object permissions is to establish a baseline (like setting Org-Wide Defaults for Accounts to Public Read Only to provide read access to all new users or configuring their profile for read access), and then use a permission set to grant the additional 'Edit' access to specific users, ensuring the principle of least privilege.

Permission sets can only grant additional permissions, they cannot be used to restrict permissions that a profile already grants or override more permissive settings.

Sharing rules extend record-level access based on criteria or ownership, not object-level Create, Read, Update, Delete (CRUD) permissions which are handled by profiles and permission sets.