vulkro-sf org psg-composition
Audits Permission Set Group composition for effective god-mode grants
(SF-PSG-COMPOSITION-001).
Cross-walks each PermissionSetGroup against its
PermissionSetGroupComponent rows and the permission flags on the
contained PermissionSet records. The rule fires when two or more
component permsets in the same group each grant the same god-mode user
permission (ModifyAllData, ViewAllData, or AuthorApex), which
means the group's aggregation is itself the structural escalation
channel.
This is the composition-only escalation that the metadata-only
SF-PERM-001 rule does not reason about: each component looks
defensible in isolation, and the risk only exists once they are
combined into one group.
Synopsis
vulkro-sf org psg-composition --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | table | json | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
PermissionSetGroup- the group directory.PermissionSetGroupComponent- which permsets each group contains.PermissionSet- the permission flags on each contained permset.
Examples
vulkro-sf org psg-composition --target-org my-prod
vulkro-sf org psg-composition -o my-prod --format json > psg.json
Exit codes
0- no findings.1- findings reported.2- error.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing leaves the machine. Only permission metadata is read, no
business records.
A finding reports a configuration shape, not a demonstrated exploitation. Group composition that aggregates god-mode permissions can be entirely intentional for a genuine administrator group: the rule surfaces it for review. A run with no findings is not a certification that the org's permission model is sound.
Where to go next
- vulkro-sf org effective-perms - who actually holds these permissions right now.
- vulkro-sf org perms - profile and permset over-privilege.