Permission Sets

Overview

OrgGuard ships three role-based permission sets covering the three roles that typically interact with an auth-governance product:

• OrgGuard Admin — full control (create/edit policies, trigger scans, configure settings, purge data)
• OrgGuard User — day-to-day governance work (view assets, triage findings, read-only on policies)
• OrgGuard Auditor — fully read-only across all governance surfaces except the Diagnostics tab

These three are the role-based access sets you assign to users. All are standard Salesforce permission sets, located in Setup → Permission Sets. They follow Salesforce’s additive permission model — assign the one that matches each user’s role, or clone and customize if your organization needs a variation.

Two additional tier-grant permission sets

Two more permission sets ship in the package — OrgGuard Pro Plus Tier and OrgGuard Max Tier. These exist only to grant the OrgGuard_Pro_Plus / OrgGuard_Max custom permissions for in-tier role grants; they are not the source of truth for your license tier (that is managed by the Salesforce License Management App). You do not normally assign these by hand, and they are independent of the three role-based sets above.

Who this page is for

Salesforce admins rolling out OrgGuard to a team, or IT/security leads deciding which users need which level of access.

---

What you’ll see

Setup → Permission Sets lists all three OrgGuard sets alongside any standard and custom sets in your org. Click a set’s label to see:

• Object Settings — which objects this set grants access to, and CRUD level on each
• Field-Level Security — per-field read/edit access
• App Permissions — any system permissions granted (e.g. View All Data)
• Assigned Apps — which Lightning apps this set grants access to (OrgGuard)
• Tab Settings — which OrgGuard tabs users see
• Manage Assignments — the list of users currently assigned to this set

---

Common tasks

Task: Assign the OrgGuard Admin permission set to a user

Use this for Salesforce admins who will create policies, run scans, and configure OrgGuard.

Who can do this: System Administrator (or any user with “Assign Permission Sets” permission).

1. Setup → Permission Sets.
2. Click OrgGuard Admin.
3. Click Manage Assignments (top of the page).
4. Click Add Assignment.
5. Check the users you want to assign; click Next, then Assign.
6. Expected result: target users can now see the OrgGuard app, access every tab, and run every action described in the Feature Guides.

Task: Assign the OrgGuard User permission set

Use this for security analysts, compliance team members, and asset owners who need to triage findings but shouldn’t be editing policies or triggering scans.

1. Setup → Permission Sets → OrgGuard User.
2. Click Manage Assignments → Add Assignment.
3. Select users and save.
4. Expected result: users can view the OrgGuard app, read assets, triage findings (acknowledge/resolve/suppress), and view scan history. They cannot create/edit policies, trigger scans, or see the Diagnostics tab.

Task: Assign the OrgGuard Auditor permission set

Use this for internal or external compliance auditors — fully read-only access across all governance surfaces except Diagnostics.

1. Setup → Permission Sets → OrgGuard Auditor.
2. Click Manage Assignments → Add Assignment.
3. Select users and save.
4. Expected result: users can see all tabs except Diagnostics, and cannot modify any record.

Task: Remove a user’s OrgGuard access

1. Open the relevant permission set’s Manage Assignments page.
2. Check the user(s) to remove.
3. Click Remove Assignments.
4. Expected result: user loses access within a few minutes (cache eviction).

If the user is assigned to multiple OrgGuard sets, remove them from each — permissions are additive.

Task: Clone a permission set to customize

Don’t edit the shipped sets directly — they get reset on package upgrade. Instead:

1. Setup → Permission Sets → OrgGuard User.
2. Click Clone.
3. Name the new set (e.g. “OrgGuard User — Findings Read-Only”).
4. Edit the clone to add or remove the permissions you need.
5. Assign users to the clone instead of the original.

Upgrades preserve your clone and its assignments.

Task: Verify a user’s effective access

Two paths:

From the user’s record:

1. Setup → Users → {user}.
2. Scroll to Permission Set Assignments to see what’s assigned.
3. Scroll to Object Permissions for effective CRUD per object.

From the permission set:

1. Open the permission set.
2. Manage Assignments — confirms the user is on the list.

---

Permission-set reference

Permission Set	Typical recipient	Read	Create/Edit	Delete	Scan Trigger	Diagnostic Logs
OrgGuard Admin	Salesforce admin, security lead	All objects	All objects	All except audit objects	Yes	Read + Export + Purge
OrgGuard User	Analyst, asset owner	All objects	Finding__c (triage fields: due date, details, assignment, acknowledgment, resolution notes)	None	No	None
OrgGuard Auditor	Compliance auditor	All objects	None	None	No	None

Protected audit records — no delete, for anyone

Finding__c, Scan_Run__c, and Notification__c records are compliance audit evidence. Deletion is blocked at the platform level by OrgGuard’s before-delete trigger guard — regardless of permission set or profile. Even OrgGuard Admin cannot delete them manually. They are purged automatically by the Data Retention policy when they age out of the configured retention window.

To retire a finding, set Status = Suppressed. To retire an asset, set Status = Deprecated.

All three permission sets grant access to the OrgGuard Lightning app. OrgGuard Admin sees all tabs including Diagnostics and Setup; OrgGuard User and OrgGuard Auditor see all tabs except Diagnostics and Setup. Differences beyond tabs are in CRUD, action-button visibility, and diagnostic-log access.

---

Troubleshooting

Symptom	Likely cause	Fix
User sees the OrgGuard app but tabs are hidden	Tab visibility defaults to Hidden on the user’s profile	The permission set enables tab visibility — re-assign, or wait a few minutes for permission cache to refresh.
User is assigned OrgGuard User but can edit policies	User also has a permission set or profile granting broader access	Check every assignment — permissions are additive.
”Trigger Scan” button disabled for a user	User lacks OrgGuard Admin permissions	Assign OrgGuard Admin.
OrgGuard User or Auditor cannot see the Diagnostics tab	Expected — Diagnostics is restricted to OrgGuard Admin only	Assign OrgGuard Admin if diagnostic access is needed; otherwise this is intentional.
Diagnostic Log Viewer shows “Error loading logs”	User lacks read access to OrgGuard_Log__c	Assign OrgGuard Admin.
User can’t see the Findings tab	Either the permission set isn’t assigned, or the profile has the tab set to Hidden	Assign one of the three OrgGuard permission sets, and verify the user’s profile hasn’t explicitly hidden the tab.
Changes to a permission set aren’t taking effect	Salesforce permission cache	Ask the user to log out and back in; cache typically refreshes in 1–2 minutes.

---

FAQ

Why three sets instead of just “Admin” and “User”? The Auditor use case — fully read-only across all governance surfaces except the Diagnostics tab — is common and non-trivial to build from scratch. Shipping it as a distinct set saves every customer the work.

Can I assign multiple OrgGuard sets to the same user? Yes — Salesforce permissions are additive. A user assigned both OrgGuard User and OrgGuard Auditor gets the union of both. In practice this is rare; pick one.

Are permission sets deployed on package upgrade? Yes. Upgrades redeploy the three shipped sets with their current definitions. Your assignments are preserved. Do not edit the shipped sets directly — upgrades will overwrite your changes. Clone and customize instead.

Does OrgGuard support Permission Set Groups? Not shipped, but you can build a Permission Set Group that includes OrgGuard User plus your own sets for a composed role. Salesforce evaluates groups as a single permission envelope.

What happens to assignments when a user is deactivated? Assignments remain but are inert. Re-activating the user restores OrgGuard access immediately.

Can I grant access to just one asset type (e.g., Certificates only)? Not via the shipped sets. You’d need to clone OrgGuard User, then add a sharing rule or restriction rule on TrackedAsset__c filtered by AssetType__c. Restriction rules are the cleanest approach for per-type scoping.

---

Related

• Asset Inventory — what OrgGuard User can do on assets
• Policies — why OrgGuard Admin is required to author
• Findings — the status/assignment edits OrgGuard User can make
• Diagnostic Logging — admin-only surface
• Scheduled Jobs — who can inspect and modify