What Is a Permission Set?

A Permission Set in Salesforce is a collection of permissions that extend a user’s existing profile.
Instead of creating multiple profiles, you assign permission sets to give additional access like:

• Report access
• Object/Field permissions
• App access
• System permissions

Profiles = baseline access
Permission Sets = extra access to selected users

This lets admins manage access flexibly.

✅ How to Give a Selected User Report Access (Admin Steps)

Step 1: Create a Permission Set

1. Go to Setup
2. Search Permission Sets
3. Click New
4. Name: Report_Access_Set
5. Save

Step 2: Enable Report Permissions

Inside your permission set, enable:

App Permissions → “Run Reports”
System Permissions → “View Reports in Public Folders”
(If needed) “Create and Customize Reports”

Step 3: Give Folder Access

Go to Reports → Folder → Share
Grant access:

• Viewer
• Editor
• Manager

Select user → Share

Step 4: Assign Permission Set to Selected User

1. Open Permission Set
2. Click Manage Assignments
3. Click Add Assignment
4. Select the user
5. Save

That user now has report access.

✅ How to Assign a Permission Set to a User (Apex Code)

// Give permission set to a selected user

Id userId = '005XXXXXXXXXXXX';      // Selected user Id
Id permSetId = [SELECT Id FROM PermissionSet 
                WHERE Name = 'Report_Access_Set' LIMIT 1].Id;

PermissionSetAssignment psa = new PermissionSetAssignment(
    AssigneeId = userId,
    PermissionSetId = permSetId
);

insert psa;

This will programmatically assign the permission set.

✅ Giving Report Folder Access via Metadata API (Apex)

Salesforce requires the Metadata API for folder sharing.
Example using Apex wrapper:

MetadataService.MetadataPort service = MetadataServiceUtils.createService();

MetadataService.FolderShare share = new MetadataService.FolderShare();
share.accessLevel = 'View';  // View, Edit, Manage
share.sharedTo = '005XXXXXXXXXXXX'; // User Id

MetadataService.ReportFolder folder = 
    (MetadataService.ReportFolder) service.readMetadata('ReportFolder', new String[] {'My_Report_Folder'}).getRecords()[0];

folder.shares = new MetadataService.FolderShare[] { share };

MetadataService.AsyncResult[] results = service.updateMetadata(
    new MetadataService.Metadata[] { folder }
);

✅ Full End-to-End Flow (Technical)

1. Create permission set (with Run Reports permission)
2. Assign it using Apex
3. Give folder access via Metadata API
4. User can now view/run reports