vulkro-sf org psg-composition
Checks the live org's permission set groups for powerful grants that appear only when their permission sets are combined.
vulkro-sf org psg-composition --target-org <alias>
vulkro-sf org psg-composition -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-PSG-COMPOSITION-001 | High (Medium for Author Apex) | Two or more permission sets in one group each grant the same Modify All Data, View All Data or Author Apex permission. |
Each permission set can look fine alone; the risk is in the group. An admin group may do this on purpose, so review each finding.
See also: org perms, org effective-perms.