We're an ISV distributing a managed package, and we're very much looking forward to including PSGs in our toolset.
Permission Set Muting is going to close a signficant gap for ISVs that complicates upgrades for some of our customers.
PSG and PSM will make it much easier for us to support a collection of finely-grained layered permission sets.
Since PSG's are expected to be promoted to Beta in Winter'19, we'd like to distribute a new collection of layered permission sets as an extension package. In this way, we can control who receives the new permsets and move more quickly with interim upgrades.
My initial tests of distributing permission sets in an extension package are working well. (So the permission sets would be in a second package that we'd install alongside the base package.)
I just wondered if anyone else was exploring this approach and had any considerations to share?
Thank you for your reply, Sharon.
I understand your point about extension packages. I can't speak to second generation packaging, but for first generation, in practice, an extension package can already create its own custom fields on base objects, as well as its own triggers on base objects, create flows, validation rules, and many other components that interact with and affect base components.
One would think that a malicous user can do much more damage with a trigger and custom fields than one could do with a permset.
And, of course, the extension package cannot do anything the local admin could not do for herself wth a custom permset.
The new permission groups and permission muting is going to open doors for ISVs with enterprise-grade packages. We will finally able to take full advantage of the finely-grained layering that the platform provides.
Being able to distribute new layered permission sets in an extension package will allows us to iterate more quickly and better serve our common customer.
I do hope that we can come to see this capability as an important feature that is very much needed by the ISV ohana.
