FAQ-001472 - Permission Set Security / Broad Permission Justification

Including broad permissions like "View All" on standard objects in a packaged permission set is considered a security risk because it allows users to view all records of an object, bypassing sharing rules and field-level security settings. This broad access can lead to unauthorized exposure of sensitive data, violating the principle of least privilege and potentially compromising data security. It provides unrestricted access to all records of the object, bypassing ownership and sharing rules, which can result in unauthorized data exposure, allowing users to access sensitive information they wouldn't normally be authorized to view. Limiting permissions to the minimum necessary is crucial for maintaining proper access control and data security.

The FAQ content is accurate and well-structured, explaining the security risks of broad permissions comprehensively. The main improvement made was removing redundant phrasing - the original answer repeated the same concept about bypassing sharing rules and unauthorized data exposure in slightly different ways. The streamlined version maintains all the key points while eliminating redundancy and improving readability. For security rules selection: 1. **ApexCRUDViolation**: This rule is directly relevant because the FAQ discusses "View All" permissions, which relates to CRUD (Create, Read, Update, Delete) security violations. The FAQ specifically mentions how broad permissions can "lead to unauthorized exposure of sensitive data" and bypass "field-level security settings," which aligns with CRUD violation concerns where proper permission checks should be enforced. 2. **ApexSharingViolations**: This rule is highly relevant because the FAQ explicitly discusses how "View All" permissions "bypass sharing rules" and "bypass ownership and sharing rules." The FAQ's core message about maintaining proper access control directly relates to sharing violations where code should respect Salesforce's sharing model rather than bypassing it through overly broad permissions.