Sf Permissions

sf-permissions

Use this skill when the user needs permission analysis and access auditing: Permission Set / Permission Set Group hierarchy views, “who has access to X?” investigations, user-permission analysis, or permission-set metadata review.

When This Skill Owns the Task

Use sf-permissions when the work involves:

• permission set / permission set group analysis
• user access investigation
• finding which permission grants object / field / Apex / flow / tab / custom-permission access
• auditing or exporting permission configuration
• reviewing permission metadata impacts

Delegate elsewhere when the user is:

• creating new metadata definitions → [sf-metadata](../sf-metadata/SKILL.md)
• deploying permission sets → [sf-deploy](../sf-deploy/SKILL.md)
• analyzing Apex-managed sharing logic → [sf-apex](../sf-apex/SKILL.md)

---

Required Context to Gather First

Ask for or infer:

• target org alias
• whether the question is about an object, field, Apex class, flow, tab, custom permission, or specific user
• whether the goal is hierarchy visualization, access detection, export, or metadata generation
• whether the output should be terminal-focused or documentation-friendly

---

Recommended Workflow

1. Classify the request

| Request shape | Default capability | |---|---| | “who has access to X?” | permission detector | | “what does this user have?” | user analyzer | | “show me the hierarchy” | hierarchy viewer | | “export this permset” | exporter | | “generate metadata from analysis” | generator or handoff |

2. Connect to the correct org

Verify sf auth before running permission analysis.

3. Use the narrowest useful query

Prefer focused analysis over broad org-wide scans unless the user explicitly wants a full audit.

When choosing identifiers, prefer stable metadata names first:

• PermissionSet.Name
• PermissionSetGroup.DeveloperName
• CustomPermission.DeveloperName
• object and field API names such as Account or Account.AnnualRevenue
• Assignee.Username / email for user-centric checks

Use Salesforce record IDs only when:

• the underlying object model requires ParentId or SetupEntityId, or
• you are drilling into records returned by a prior read-only query in the same investigation

4. Render findings clearly

Use:

• ASCII tree or table output for terminal work
• Mermaid only when documentation benefit is clear
• concise summaries of which permission source grants access

5. Hand off creation or deployment work

Use:

• [sf-metadata](../sf-metadata/SKILL.md) for richer metadata generation
• [sf-deploy](../sf-deploy/SKILL.md) for deployment

---

High-Signal Rules

• distinguish direct Permission Set grants from grants via Permission Set Groups
• prefer Name / DeveloperName / API names over org-specific record IDs for first-pass investigation queries
• be explicit about whether access is object-level, field-level, class-level, flow-level, or custom-permission-based
• use Tooling API where required for setup entities and advanced visibility questions
• for agent access questions, verify exact agent-name matching in permission metadata
• when a follow-up child query requires ParentId or SetupEntityId, resolve the ID from a prior result instead of starting with copied IDs

---

Output Format

When finishing, report in this order:

1. What was analyzed
2. Org / subject scope
3. Which permissions grant access
4. Whether access is direct or inherited
5. Recommended follow-up

Suggested shape:

Permission analysis: 
Scope: 
Findings: 
Source: 
Next step: 

---

Cross-Skill Integration

| Need | Delegate to | Reason | |---|---|---| | generate or modify permission metadata | [sf-metadata](../sf-metadata/SKILL.md) | metadata authoring | | deploy permission changes | [sf-deploy](../sf-deploy/SKILL.md) | rollout | | identify Apex classes needing grants | [sf-apex](../sf-apex/SKILL.md) | implementation context | | bulk user assignment analysis | [sf-data](../sf-data/SKILL.md) | larger data operations |

---

Reference Map

Start here

• [references/permission-model.md](references/permission-model.md)
• [references/soql-reference.md](references/soql-reference.md)
• [references/workflow-examples.md](references/workflow-examples.md)

Specialized analysis

• [references/agent-access-guide.md](references/agent-access-guide.md)
• [references/usage-examples.md](references/usage-examples.md)

---

Score Guide

| Score | Meaning | |---|---| | 90+ | strong permission analysis with clear access sourcing | | 75–89 | useful audit with minor gaps | | 60–74 | partial visibility only | | < 60 | insufficient evidence; expand analysis |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Jaganpro
• Source: Jaganpro/sf-skills
• License: MIT

Install and usage instructions live in the source repository linked above.