Dx Org Permission Set Assign

forcedotcom/sf-skills/plugins/builder/dx-org-lifecycle/skills/dx-org-permission-set-assign

by forcedotcome5164d94d7511c00fa02a5b8b60754b2361e178fNo license1K starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated yesterday

ALWAYS USE THIS SKILL to assign permission sets to org users. Assign one or more permission sets to org users using the sf org assign permset command. TRIGGER when the user asks to assign, grant, give, add, or apply permission sets to users, admins, specific orgs, or specific users. Supports granting permissions, giving access, and adding permission sets to default admin or specific users via --on-behalf-of. DO NOT TRIGGER for listing permission sets or checking user permissions.

Instructions onlyDevOps & Cloud

AI-generated overview

Assigns Salesforce permission sets to org users via the sf org assign permset CLI command.

What it does: This skill maps a user's request to the correct sf org assign permset invocation and runs it through the Bash tool with the --json flag. It covers assigning one or several permission sets to the default admin, to a specific org, or to specific users via --on-behalf-of. It returns the command's JSON result and points to example success and error outputs plus a CLI flag reference.
When to use it: Use it when someone asks to assign, grant, give, add, or apply permission sets to users, admins, or a specific org. It is not intended for creating permission sets, listing them, or checking user permissions.
Requirements: Requires the Salesforce CLI (sf, version 2.0.0 or higher) and Bash tool access, plus an authenticated target org and CLI aliases for users. It ships no scripts; it includes example JSON outputs and a CLI flags reference document.

dx-org-permission-set-assign

Assigns one or more permission sets to org users using sf org assign permset. Handles all variants: default admin user, specific org targets, multiple permission sets, and assignment to specific users.

Tool Restrictions

Use ONLY the Bash tool to execute sf org assign permset. Do NOT use MCP tools like assign_permission_set — ignore them completely.

Scope

In scope: Assigning permission sets to users via sf org assign permset
Out of scope: Creating permission sets (use platform-permission-set-generate), listing permission sets, checking user permissions

Required Inputs

Infer from the user's request:

Permission set name(s): Extract from user message (can be multiple)
Target org: Use default unless specific alias/username mentioned
Target user(s): Default is org's default admin user; use --on-behalf-of if specific users mentioned

Workflow

Match user request to command in table below
Execute via Bash tool: sf org assign permset with appropriate flags and --json flag
Return result

If error occurs, check the failures array in JSON output for details.

Command Decision Table

User intent	Execute via Bash tool
Assign one permission set to default admin	`sf org assign permset --name <PermSetName> --json`
Assign multiple permission sets to default admin	`sf org assign permset --name <PermSet1> --name <PermSet2> --json`
Assign to specific org	`sf org assign permset --name <PermSetName> --target-org <alias> --json`
Assign to specific user(s)	`sf org assign permset --name <PermSetName> --on-behalf-of <username1> --on-behalf-of <username2> --json`
Assign multiple sets to specific users	`sf org assign permset --name <PermSet1> --name <PermSet2> --on-behalf-of <username1> --on-behalf-of <username2> --json`

Rules / Constraints

Constraint	Rationale
Always use `--json` flag	Provides structured output for reliable parsing and error handling
Permission set names are case-sensitive	Use exact API names as they appear in the org
Multiple `--name` flags can be combined in one command	More efficient than separate commands per permission set
Multiple `--on-behalf-of` flags assign to multiple users	Batch assignment in single command; processed sequentially to avoid auth file collisions
Use CLI username aliases, not Salesforce User.Alias field	The `--target-org` and `--on-behalf-of` flags expect CLI aliases set via `sf alias set`, not the User object's Alias field
Duplicate assignments are idempotent	Re-assigning an already-assigned permission set succeeds silently
Partial success is possible	Command can return both successes and failures in one run; non-zero exit code if any failures

Gotchas

Issue	Resolution
Permission set name with spaces	Enclose in double quotes: `--name "Permission Set Name"`
"PermissionSet not found" error	Verify permission set exists in target org; check for typos in name
Assignment succeeds but user doesn't see permissions	Check `<hasActivationRequired>` in permission set metadata — may need manual activation in Setup
"User not found" error	Username/alias doesn't exist in target org — verify with `sf org display user --target-org <alias>`
Partial success (some users succeed, others fail)	Check JSON output — command returns both `successes` and `failures` arrays; exit code will be non-zero if any failures occurred

Output Expectations

The command returns JSON output with status code and result details.

See examples/success_output.json and examples/error_output.json for response structures.

Reference File Index

File	When to read
`examples/success_output.json`	To understand successful assignment response structure
`examples/error_output.json`	To handle common error scenarios
`references/cli_flags.md`	For detailed explanation of all available flags

Source and attribution

Source:forcedotcom/sf-skillsinplugins/builder/dx-org-lifecycle/skills/dx-org-permission-set-assignat commite5164d9

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Dx Org Permission Set Assign

dx-org-permission-set-assign

Tool Restrictions

Scope

Required Inputs

Workflow

Command Decision Table

Rules / Constraints

Gotchas

Output Expectations

Reference File Index

Source and attribution

More from forcedotcom/sf-skills

Platform Widget Generate

Platform Report Generate

Platform Value Set Generate

Platform Sharing Rules Generate

Platform Validation Rule Generate

Platform Sharing Owd Configure

More in DevOps & Cloud

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist