Skip to content

Commit ae4e46d

Browse files
irisli007irisli0
irisli007
and
irisli0
authored
W-21367283: Add skills for metadata permission set generation (#23)
* initial skill for perm sets * more edits * changes after testing * more changes * address comments * standard tabs should have prefix * remove apache license --------- Co-authored-by: irisli <irisli@salesforce.com>
1 parent ff08ad5 commit ae4e46d

1 file changed

Lines changed: 171 additions & 0 deletions

File tree

‎skills/generate-permission-set/SKILL.md‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
name: generate-permission-set
3+
description: Generates correct, deployable Salesforce permission set metadata (PermissionSet XML) with object, field, user, and app permissions. Use when creating or editing permission set metadata, PermissionSet XML, object permissions, field-level security (FLS), tab visibility, or deploying permission sets.
4+
compatibility: Salesforce Metadata API v60.0+
5+
metadata:
6+
author: afv-library
7+
version: "1.0"
8+
---
9+
10+
## When to Use This Skill
11+
12+
Use when generating or editing permission set metadata, or when granting object, field, user, and app permissions.
13+
14+
## Step 1: Define Core Properties
15+
16+
Start by defining the required permission set properties:
17+
18+
```xml
19+
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
20+
<fullName>YourPermissionSetName</fullName>
21+
<label>Display Name for Administrators</label>
22+
<description>Clear description of purpose and intended audience</description>
23+
</PermissionSet>
24+
```
25+
26+
**Naming conventions:**
27+
- Use descriptive API names (e.g., `Sales_Manager_Access`)
28+
29+
## Step 2: Configure Object Permissions
30+
31+
Add CRUD permissions for standard and custom objects:
32+
33+
```xml
34+
<objectPermissions>
35+
<allowCreate>true</allowCreate>
36+
<allowRead>true</allowRead>
37+
<allowEdit>true</allowEdit>
38+
<allowDelete>false</allowDelete>
39+
<modifyAllRecords>false</modifyAllRecords>
40+
<viewAllRecords>false</viewAllRecords>
41+
<viewAllFields>false</viewAllFields>
42+
<object>Account</object>
43+
</objectPermissions>
44+
```
45+
46+
## Step 3: Set Field-Level Security
47+
48+
Define field permissions for sensitive or custom fields:
49+
50+
```xml
51+
<fieldPermissions>
52+
<editable>true</editable>
53+
<readable>true</readable>
54+
<field>Account.SSN__c</field>
55+
</fieldPermissions>
56+
```
57+
58+
**Important:**
59+
- Required fields must NEVER appear in list of field permissions. Granting field-level security on required fields is not allowed by the platform and will cause deployment failure.
60+
- Before adding any field, confirm from the object metadata that the field exists and is not required
61+
- A field is required when its metadata contains `<required>true</required>`:
62+
```xml
63+
<fields>
64+
<fullName>FieldName__c</fullName>
65+
<required>true</required>
66+
</fields>
67+
```
68+
- Use format `ObjectName.FieldName` for field references
69+
- Set both readable and editable to true when the user needs edit access; editable implies readable
70+
- If all fields should be visible, can alternatively enable the "viewAllFields" object permission
71+
72+
## Step 4: Grant User Permissions
73+
74+
Add system-level permissions for features and capabilities:
75+
76+
```xml
77+
<userPermissions>
78+
<enabled>true</enabled>
79+
<name>ApiEnabled</name>
80+
</userPermissions>
81+
<userPermissions>
82+
<enabled>true</enabled>
83+
<name>RunReports</name>
84+
</userPermissions>
85+
```
86+
87+
**Common permissions:**
88+
- `ApiEnabled`: API access
89+
- `ViewSetup`: View Setup menu
90+
- `ManageUsers`: User management
91+
- `RunReports`: Report execution
92+
93+
**Security review required for:**
94+
- `ViewAllData`: Read all records
95+
- `ModifyAllData`: Edit all records
96+
- `ManageUsers`: User administration
97+
98+
## Step 5: Configure App and Tab Visibility
99+
100+
Make applications and tabs visible to users:
101+
102+
```xml
103+
<applicationVisibilities>
104+
<application>Sales_Console</application>
105+
<visible>true</visible>
106+
</applicationVisibilities>
107+
<tabSettings>
108+
<tab>CustomTab__c</tab>
109+
<visibility>Visible</visibility>
110+
</tabSettings>
111+
```
112+
113+
**Application visibility options:**
114+
- <visible> can be true or false
115+
116+
**Tab visibility options:**
117+
- `Visible`: Always shown
118+
- `Available`: Available but not default
119+
- `Hidden`: Not visible
120+
121+
**CRITICAL - Tab Naming:**
122+
- Custom object tabs: MUST include the __c suffix (e.g., MyCustomObject__c)
123+
- Standard object tabs: Use the object name with "standard-" prefix (e.g., standard-Account, standard-Contact)
124+
- The tab name matches the object's API name exactly
125+
126+
## Step 6: Add Apex and Visualforce Access (Optional)
127+
128+
Grant access to custom code:
129+
130+
```xml
131+
<classAccesses>
132+
<apexClass>CustomController</apexClass>
133+
<enabled>true</enabled>
134+
</classAccesses>
135+
<pageAccesses>
136+
<apexPage>CustomPage</apexPage>
137+
<enabled>true</enabled>
138+
</pageAccesses>
139+
```
140+
141+
## Step 7: Set License and Record Type Settings (Optional)
142+
143+
Specify license requirements and record type visibility:
144+
145+
```xml
146+
<license>Salesforce</license>
147+
<hasActivationRequired>false</hasActivationRequired>
148+
<recordTypeVisibilities>
149+
<recordType>Account.Business</recordType>
150+
<visible>true</visible>
151+
<default>true</default>
152+
</recordTypeVisibilities>
153+
```
154+
155+
## Validation Checklist
156+
157+
Before deploying, verify:
158+
- [ ] fullName, label, description set
159+
- [ ] Permissions follow least privilege
160+
- [ ] No required fields in `<fieldPermissions>`
161+
- [ ] No duplicate permissions
162+
- [ ] no lengthy comments
163+
164+
## What Causes Deployment Failure
165+
166+
- **Field permissions on required fields:** Any required field in `<fieldPermissions>` fails deployment. Required fields cannot have FLS; omit them entirely. Always confirm from object/field metadata that a field exists and is not required—never assume.
167+
- **Incorrect API names:** Using the wrong name or missing suffixes (e.g. missing `__c` for custom objects, fields, tabs) cause failure.
168+
169+
## Deployment
170+
171+
Deploy using Salesforce CLI

0 commit comments

Comments
 (0)