What a Real Salesforce Access Review Requires (That Setup Doesn't Give You)
- Architect
- 8 hours ago
- 2 min read
Security teams are asking Salesforce admins for access reviews more often than they used to, and not because anything went wrong. As orgs bring in more automation and more agents that act on a user's behalf, "who can touch what" stopped being a question admins alone had to answer — it's now a question security and compliance teams ask directly, on a schedule, whether or not there's an incident behind it.
The problem is that Salesforce's native tools weren't built to answer that question in one pass. A real access review is really three separate questions, and Setup makes you answer each one a different way.
What does this permission set actually grant?
Someone created "Sales Ops Extended" to fix one access problem. Someone else added a field permission to it eight months later to fix a different one. By the time it's under review, nobody can say what it grants without opening three separate Setup pages.
Permission Sets Reporting Helper, part of Power User Toolkit, picks any permission set apart into one accordion view — system permissions, object-level CRUD, and field-level read/edit — all open by default, each section exportable to its own CSV for the review file.
Who can see this specific field?
An access review often starts from the sensitive side, not the permission set side: a specific field gets flagged, and the question becomes who can reach it. Checking that natively means opening every profile and permission set in the org, one at a time.
Fields Access Explorer answers it from the field's side instead — pick an object, pick a field, and see every profile, permission set, and permission set group with read or edit access to it, in one tabbed view.
What's granted temporarily, and is it still needed?
Not all access is meant to be permanent. A contractor's permission set with a 90-day expiration, or incident-response access set to lapse in a week — a proper review checks whether those are still doing their job, not just whether they exist.
Expiring Permission Sets Assignments lists every assignment with an expiration date inside a chosen window, soonest first, with a direct link into Setup to extend or revoke each one on the spot.
Three tools, one review
None of these three replace each other — a permission set audit doesn't tell you who can see one specific field, and a field lookup doesn't tell you what's about to expire. Run together, they cover what a real access review actually requires: what's granted, who has it, and how long it's supposed to last. That's the difference between telling a security team "we believe access is appropriately scoped" and handing them the actual documentation.
For the full breakdown of each tool individually, see What Does This Permission Set Actually Grant?, Who Can Actually See That Field?, and The Permission Set Assignment About to Expire That No One Noticed. Or start at the Power User Toolkit overview.
Comments