salesforce-permission-model-review-skill

name

salesforce-permission-model-review-skill

description

Use this skill when Salesforce profiles, permission sets, permission set groups, permission set licenses, muting permission sets, sharing rules, OWD, role hierarchy, IP restrictions, or session policies must be reviewed for toxic combinations and over-privilege. Flags: ModifyAllData with broad assignment, ViewAllData on PII objects, API Enabled without IP restriction, Customize Application outside admin profiles, and sharing-rule widening on regulated-data objects. Trigger phrases: "review this permission model", "check for toxic permission combinations", "is this permission set safe", "review sharing rules on this object", "assess our OWD and role hierarchy". Do not use when you need a full org posture review (use salesforce-org-assessment-skill), when metadata quality is the focus (use salesforce-metadata-review-skill), or when a live permission change is being proposed (use salesforce-live-change-approval-protocol). Works from sanitized exports only; never requests live org access.

Salesforce Permission Model Review Skill

Purpose

This skill reviews the Salesforce permission model — profiles, permission sets, permission set groups, permission set licenses, muting permission sets, sharing rules, OWD, role hierarchy, IP restrictions, and session policies — for over-privilege, toxic combinations, and sharing design risk. It flags combinations that create security or compliance exposure and produces a structured findings report. It does not access live orgs or authorize changes.

When to use

• A permission audit is required before a compliance review or certification.
• A new permission set or profile is being designed and needs adversarial review.
• Guest-user access patterns or sharing rule changes need security review.
• A toxic-permission alert has been raised and must be investigated.

When not to use

• Full org posture assessment — use salesforce-org-assessment-skill.
• Metadata quality review (fields, layouts) — use salesforce-metadata-review-skill.