Silent metadata-configuration loss when packaging Permission Sets (2GP) — architects, watch for this
Ran into packaging gotcha worth flagging to this group: if Permission Set includes standard object permissions or user permissions, 2nd-generation package builds clean — no error, no warning at build time, none at install time either. But those permission entries get silently stripped during install. Permission set deploys "successfully" and ends up empty of the very perms you configured.
No compile error. No validation warning. Just quiet divergence between metadata you packaged and metadata that lands in subscriber org — typically surfaces only when integration user hits FLS/object-access failure in production, and someone burns hours tracing it back to packaging, not code.
For anyone architecting managed/2GP packages with permission sets: worth auditing what's actually landing post-install, not just trusting deploy success.
Idea open on Salesforce Ideas asking for standard object perms + user perms to be packageable. Even short of full support, ask includes smaller ask that'd solve most of the pain: raise build-time error when permission set contains unsupported permission types, instead of silent drop.
Upvotes appreciated if you've hit this too:
https://ideas.salesforce.com/s/idea/a0B8W00000GdxqTUAR/permission-sets-allow-standard-object-permissions-to-be-packagedCurious if others in this group have workarounds beyond post-install Apex/Flow to re-grant these perms.
Currently I don't see any viable script for the post-install automation.
Apex deployment mechanism (MetadataOperations class) doesn't support Permission Set, only Layout and CustomMetadata are supported, so this is not an option.
Other options like leveraging Metadata API or Tooling API require session token. Previously we could use UserInfo.getSessionId() but now it is forbidded by AppExchange Security Review policies. Anyway, in post install context Session Id was blank.
I am considering to open view more ideas for this:
- to get a clear error when something is supposed to be packaged and included in the package but it is not;
- to get an option to deploy unpackaged PermissionSet so that integration flow could be established
