I always keep my profile metadata outside of the project default directory in order to have better control over deployment and retrieval of the metadata.

When deploying a profile from source this way to an environment where the profile does not already exist, extra permissions (i.e., those not defined in source) are added to the Profile in the Org. I think everyone has come across this.

But it just occurred to me that this may be happening because new Profiles deployed from source are following the same process as new Profiles created in the Org (i.e., a default profile is marked as the cloning, guessing the Standard profile). This may be old news, but just dawned on me :)

It got me wondering if anyone has come across a plugin that lets me define what Profile to clone from when I deploy a new Profile to an Org from source. Would also be a great feature enhancement to the CLI.

FWIW, a workaround I'm using is to manually create the Profile in the target environment cloning from Minimum Access. This creates essentially an empty shell and when deploying the Profile metadata to the Org, only the permissions and settings defined there are deployed.