You can quickly scan and understand what level of access is being granted by profiles, permission sets or permission set groups in your Org. You can use that to both plan your permission optimisation and quickly understand what a given profile, permission set or permission set group does.
Prerequisites
You must be on an Enterprise license or have a consulting space
You must have a synced Org Model
View access to the Org Model within the Elements app
Scheduled batch job in the managed package to get profile data
Report on access given by profiles, permission sets, or permission set groups
To understand what permissions are granted by permission controllers in your Org, and to understand which ones may be granting too many permissions, run the access categories report. To do that:
Open the Org model app;
Click on a report icon in the top right corner of the screen;
Click to run a new report;
Choose 'Understand size and purpose of permission controllers' from the dropdown;
When the report is ready, click on the notification from the report icon.
The report will list every profile, permission set and permission set group in the Org as rows and every category of permissions as columns (e.g. object permissions, field permissions, etc). The numbers in the cell indicate how many metadata are accessible using that permission controller.
For instance, if a profile shows 430 field permissions, that means it grants access to a total of 430 fields in the Org.
Review access granted by a given profile, permission set or permission set group
Using Elements.cloud application, you can analyze what permissions are being granted by each profile, permission set or permission set group.
To see which permissions are being granted by:
Find the right permission component in your Org model
Open the Insights tab in the right panel and navigate to the Access sub-tab
Click on the 'Analyze access' button
You will see a grid of types of permissions (e.g. object permissions) and a number (e.g. 7). That number indicates how many permissions of that type are being granted.
Click on the number to drill down and see the concrete, alphabetically sorted list of metadata and the level of access granted by the permission controller.
