How do roles and permission sets differ in their use for access management?

• A. Roles define a base set of privileges; permission sets grant additional or elevated permissions on top.
• B. Roles and permission sets are the same thing.
• C. Permissions sets replace roles when a user changes teams.
• D. A permission set defines a department; a role assigns tasks.

Answer: (A)

Roles establish the baseline data access and what a user can see within the organization, often tied to the hierarchy and sharing rules. Permission sets provide additional or elevated permissions on top of that baseline without changing the user’s role. In practice, you assign roles to set the default data visibility, and you add permission sets to grant extra object permissions, field access, or system privileges as needed. Multiple permission sets can be combined for a user and can be added or removed as requirements change, including temporary access. This additive, non-replacing relationship is why the first option is the best description. The other statements aren’t accurate because roles and permission sets aren’t the same, permission sets don’t replace a role when switching teams, and they don’t define departments or assign tasks.