Be aware of these considerations and special behaviors for permission sets.
Available in: Salesforce Classic and Lightning Experience
Available in: Contact Manager, Professional, Group, Enterprise, Performance, Unlimited, Developer, and Database.com Editions
Additional permission sets available for an extra cost in Professional Edition
Differences between new and cloned permission sets
A new permission set starts with no user license selected and no permissions enabled. A cloned permission set has the same user license and enabled permissions as the permission set that it’s cloned from. You can’t change the user license in a cloned permission set. Clone a permission set only if the new one requires the same user license as the original.
In Enterprise, Performance, Unlimited, Developer, and Database.com editions, you can create up to 1,000 permission sets. In Contact Manager, Group, and Professional Editions, you can create one permission set.
In Group, Professional, Enterprise, Performance, Unlimited, Developer, and Database.com editions, organizations can have more permission sets if they’re added as part of an installed managed package that’s publicly listed on AppExchange. In this case, organizations can have up to 1,500 permission sets.
User license restrictions
Some user licenses restrict the number of custom apps or tabs that a user can access. In this case, you can assign only the allotted number through the user’s assigned profile and permission sets. For example, a user with the Force.com App Subscription user license with access to one Force.com Light App can access only that app’s custom tabs.
Assigned app settings specify the apps that users can select in the Force.com app menu. Unlike profiles, you can’t assign a default app in permission sets. You can only specify whether apps are visible.
Apex class access
You can specify which methods in a top-level Apex class are executable for a permission set. Apex class access settings apply only to:
Apex class methods, such as Web service methods
Any method used in a custom Visualforce controller or controller extension applied to a Visualforce page
Triggers always fire on trigger events (such as insert or update), regardless of permission settings.