Skip to main content

Permission Sets Explained

The aprity managed package ships three permission sets:

LabelAPI nameGive it to
aprity AdminAprity_AdminThe administrators who set up aprity and launch analyses
aprity UserAprity_UserEveryone who reads the documentation
aprity Agent UserAprity_AgentUserUsers who ask the Org Expert questions through Agentforce

These permission sets decide two things at once: what a user sees in the aprity app in Salesforce, and their role in the aprity web portal.

aprity Admin​

The administrator permission set. It includes everything in aprity User, plus:

  • Setup and registration: running the setup wizard, registering the org with an activation code, and entering the External Client App details. The setup wizard's first checklist item asks you to assign this permission set to yourself.
  • New Analysis: launching analyses.
  • BYOLLM page in the aprity app, when your plan includes BYOLLM.
  • Portal administrator role: the portal account menu shows Connectors; the Human corrections page offers a Moderation mode.

aprity User​

The reader permission set:

  • Opens the aprity app in Salesforce, with the list of past Analyses, the Web portal page that links to your documentation, and the Agentforce page when your plan includes it.
  • Signs in to the web portal as a reader: all documentation, the AI assistants included in your plan, the migration backlog and Human corrections.

A user with aprity User cannot launch analyses or change any configuration.

Both roles in one user

An administrator does not need aprity User in addition to aprity Admin: aprity Admin already includes reader access.

aprity Agent User​

Grants access to the aprity actions used by the Org Expert inside Agentforce. Assign it to the users who will chat with the Org Expert in Salesforce, and only if your plan includes the Org Expert (Intelligence or Trial). It does not give access to the aprity app or the web portal: add aprity User if those users should also read the documentation there.

See Agentforce Setup.

Portal access depends on these permission sets​

When someone signs in to the web portal with Salesforce, aprity checks which aprity permission set is assigned to that user in your org:

  • aprity Admin → portal administrator;
  • aprity User → portal reader;
  • neither → the sign-in is refused.
Assign directly, not only through a Permission Set Group

The portal checks for a direct assignment of Aprity_Admin or Aprity_User. A user who receives them only through a Permission Set Group may be refused at portal sign-in. Assign the aprity permission sets to users directly.

The user's profile must also be allowed to use the aprity External Client App. See Managing the External Client App.

Assigning permission sets​

To one user​

  1. Go to Setup > Users > Users and open the user.
  2. In Permission Set Assignments, click Edit Assignments.
  3. Move aprity Admin or aprity User to Enabled Permission Sets.
  4. Click Save.

To many users​

  1. Go to Setup > Permission Sets and open aprity User (or aprity Admin).
  2. Click Manage Assignments, then Add Assignment.
  3. Select the users and click Assign.

For large rollouts, you can also insert PermissionSetAssignment records with Data Loader, or use the Salesforce CLI:

sf org assign permset --name Aprity_User --on-behalf-of user@example.com

Common set-ups​

Team memberPermission sets
Salesforce administrator running aprityaprity Admin
Business analyst, developer, product owneraprity User
Business user asking questions in Agentforceaprity Agent User (+ aprity User to also read the portal)

Checking an assignment​

Open the user in Setup > Users > Users and look at Permission Set Assignments. If a user cannot sign in to the portal or does not see an aprity page, this is the first thing to check. See Portal Login Fails and Missing Tabs or Features.