The System Administrator at a nonprofit organization is assigning permission sets to users for the organization’s new Nonprofit Cloud implementation…

To provide read-only access, an administrator must ensure users have "Read" permission but not "Edit" or "Delete" permissions for the specified objects. If users are assigned permissions via a Permission Set Group that grants broader access (e.g., edit), a Muting Permission Set can be added to that group. The muting set would explicitly remove the "Edit" and "Delete" permissions for the Fundraising and Grantmaking objects, effectively limiting the user's access to read-only for those objects within the group.

A. Restriction Rules do not control object-level permissions (like read-only). They filter which records a user can see after access has been granted, based on record criteria.

C. Sharing Rules are used to grant users more access to records than the organization-wide defaults allow. They open up access, they do not restrict it to read-only.

1. Salesforce Help. (2023). Muting Permission Sets. Salesforce. Retrieved from https://help.salesforce.com/s/articleView?id=sf.permsetgroupsmuting.htm&type=5. (This document explains that a muting permission set lets you disable, or mute, selected permissions in a permission set group).

2. Salesforce Help. (2023). Restriction Rules. Salesforce. Retrieved from https://help.salesforce.com/s/articleView?id=sf.securityrestrictionrules.htm&type=5. (This source defines Restriction Rules as a tool to enhance security by allowing only certain records to be visible to specified users, confirming it is for record visibility, not object permissions).