One baseline profile, everything else in permission sets. Here is why. This page is demo content generated for the theme — replace it with the real thing, keep the tags.
The rule
State the convention plainly, then show the one exception worth knowing.
In practice
What this looks like in a real org with real users mid-quarter.
Try it yourself
- Open your Developer Edition org and follow along
- Change one thing at a time and note what happens
- When something breaks, read the error before searching it