> For the complete documentation index, see [llms.txt](https://help.sdocs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.sdocs.com/sdocs/administration/security/s-docs-permission-sets.md). # S-Docs Permission Sets ## SDocs Managed Package Permission Sets ### Permission Sets Overview * [S-Doc eSignature Requester](#s-doc-esignature-requester) — Allows internal users (like Sales or Operations) to prepare, send, and track S-Docs for eSignature. * [S-Doc eSignature Signer](#s-doc-esignature-signer) — Grants external or portal users access to the signing experience to review and sign documents. * [SDocs Administrator](#sdocs-administrator) — Gives Salesforce Admins full control over day-to-day configuration, templates, jobs, and package settings. * [SDocs Jobs (Guest Users)](#sdocs-jobs-guest-users) — Allows Site Guest Users to run automated document generation jobs with mostly read-only package access. * [SDocs LWC Community User](#sdocs-lwc-community-user) — Enables Experience Cloud users to generate and view documents without modifying template definitions. * [SDocs User](#sdocs-user) — Allows standard internal users to generate and view documents, restricting access to template administration. * [S-Doc Site Guest User](#s-doc-site-guest-user) — Legacy (Do Not Use) * [S-Docs Minimum Access User](#s-docs-minimum-access-user) — Provides a lightweight baseline of package visibility, intended to be stacked with other permissions. * [S-Docs Support Admin](#s-docs-support-admin) — Allows Admins to access diagnostic tabs for troubleshooting. ## Permission Set Details ### S-Doc eSignature Requester API Name: `SDOC__SD_eSign_Requester` Target Persona: Internal document sender / operations user Description: This permission set is for users who initiate and manage eSignature requests from S-Docs. It allows creating envelopes, adding recipients, and preparing inputs needed for signing workflows. It also includes broad control over key eSignature configuration and event objects to keep requests moving. Object & Feature Access | Object / Feature | Access Level | Description | | ------------------------------------------------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------- | | Envelope (`SDOC__Envelope__c`) | Create, Read, Update, Delete | Manage eSignature envelope lifecycle for documents being sent out. | | Recipient (`SDOC__Recipient__c`) | Create, Read, Update, Delete | Add and maintain signer/recipient details for each envelope. | | Document (`SDOC__SDoc__c`) | Create, Read, Update, Delete | Work with S-Docs records linked to eSignature activity. | | Input Data (`SDOC__SDocInput__c`) | Create, Read, Update, Delete | Capture and maintain signer input data points used during signing. | | Envelope Field Configuration (`SDOC__Envelope_Document_Field_Configuration__c`) | Create, Read, Update, Delete, View All, Modify All | Configure and control where fields are placed and how they behave in envelope documents. | | Envelope Events (`SDOC__Event__c`) | Create, Read, Update, Delete, View All, Modify All | Track and manage event history and status transitions across eSignature activity. | | eSignature app tab (`SDOC__eSignature`) | Visible | Gives direct UI access to S-Docs eSignature features. | | S-Docs homepage tab (`SDOC__S_Docs_Homepage`) | Visible | Provides entry point to package homepage utilities. | Admin Notes * Prerequisites: Users typically also need access to relevant business records (for example, Account/Opportunity/Case) and any org-level email deliverability requirements. * Stacking: Usually assigned as a standalone role for request initiators; combine with `SDOC__SDocs_User` only if the same user also needs standard non-eSignature document generation. * Limitations/Security Warnings: **Includes `View All` and `Modify All` on `SDOC__Envelope_Document_Field_Configuration__c` and `SDOC__Event__c`.** Treat this as elevated data access and assign only to trusted users. ### S-Doc eSignature Signer API Name: `SDOC__SD_eSign_Signer` Target Persona: External signer / portal signer Description: This permission set is focused on the signing experience rather than document administration. It grants access to S-Docs signing and PDF pages needed to review and sign documents. It does not provide object-level create/update management over S-Docs data objects. Object & Feature Access | Object / Feature | Access Level | Description | | ------------------------ | -------------- | ------------------------------------------------------------------------------- | | Signing experience pages | Feature access | Provides access to the signer workflow pages used to review and sign documents. | | PDF rendering pages | Feature access | Allows signed document and PDF display during the signing process. | Admin Notes * Prerequisites: Ensure the user can authenticate through the intended channel (Experience Cloud/site or direct signing link flow) and has access to the hosted signing entry point. * Stacking: Usually assigned alone for signer-only users; combine with community/site access controls when signers authenticate through Experience Cloud. * Limitations/Security Warnings: No broad object CRUD is included in this set, so it is purpose-built for signing UI access. ### SDocs Administrator API Name: `SDOC__SDocs_Administrator` Target Persona: Salesforce Admin / SDocs power admin Description: This is the full administration-oriented SDocs permission set for configuring templates, running generation jobs, and operating package tools. It supports day-to-day management of document generation and troubleshooting. Use this for admins or delegated power users who own S-Docs operations. Object & Feature Access | Object / Feature | Access Level | Description | | ------------------------------------------------------------------------------------------ | ---------------------------- | --------------------------------------------------------------------------- | | Templates (`SDOC__SDTemplate__c`) | Create, Read, Update, Delete | Create and maintain document templates and output behaviors. | | Documents (`SDOC__SDoc__c`) | Create, Read, Update, Delete | Manage generated S-Docs records and related outputs. | | Jobs (`SDOC__SDJob__c`) | Create, Read, Update, Delete | Run and monitor asynchronous/batch document generation jobs. | | Relationships (`SDOC__SDRelationship__c`) | Create, Read, Update, Delete | Control relationship records linking generated docs to business data. | | Actions (`SDOC__SDAction__c`) | Create, Read, Update, Delete | Maintain package action definitions used in generation workflows. | | Logs (`SDOC__SDLog__c`) | Create, Read, Update, Delete | Review and manage package diagnostic/logging records. | | Envelope (`SDOC__Envelope__c`) | Create, Read, Update, Delete | Manage eSignature envelopes used within S-Docs processes. | | S-Docs app (`SDOC__S_Docs_App`) | Visible | Exposes the main S-Docs application shell to the user. | | Admin/support tabs (for example `SDOC__SDTemplate__c`, `SDOC__SDHelp`, `SDOC__eSignature`) | Visible | Gives direct UI entry into template management, help, and eSignature areas. | Admin Notes * Prerequisites: Usually paired with broad baseline Salesforce access to records being merged (for example, Account/Contact/Opportunity data) and email-sending capability where document emailing is used. * Stacking: Can be used alone for full S-Docs administration; no additional S-Docs user set is typically required. * Limitations/Security Warnings: This set is high-impact because it grants full CRUD on core S-Docs admin objects and template assets. **Assign only to trusted admins or delegated super users.** ### SDocs Jobs (Guest Users) API Name: `SDOC__SDocs_Jobs_Guest_Users` Target Persona: Site guest automation user Description: This permission set supports guest-user document job execution in public-facing scenarios. It is mostly read-only across package objects, with limited create/read access to job records. Use it to enable controlled background processing for guest flows. Object & Feature Access | Object / Feature | Access Level | Description | | --------------------------------- | ------------ | --------------------------------------------------------------------- | | Jobs (`SDOC__SDJob__c`) | Create, Read | Allows guest context to create and read generation job records. | | Templates (`SDOC__SDTemplate__c`) | Read | Allows job processing to reference templates without editing them. | | Documents (`SDOC__SDoc__c`) | Read | Allows access to generated document references needed by guest flows. | | Actions (`SDOC__SDAction__c`) | Read | Allows package action metadata lookup during guest execution. | | Envelope (`SDOC__Envelope__c`) | Read | Allows guest flows to read envelope status/state when needed. | Admin Notes * Prerequisites: Configure secure guest user sharing and object access at site level so only intended records are exposed. * Stacking: Typically assigned to a site guest user profile context, and often paired with `SDOC__S_Doc_Site_Guest_User` for end-user-facing guest interactions. * Limitations/Security Warnings: Guest access is inherently sensitive; keep sharing rules strict and validate that exposed records are the minimum required. ### SDocs LWC Community User API Name: `SDOC__SDocs_LWC_Community_User` Target Persona: Experience Cloud community user Description: This set enables document generation and viewing for authenticated community users. It supports job creation and document lifecycle activity while keeping template definitions read-only. Use it when external community users need to generate documents from approved templates. Object & Feature Access | Object / Feature | Access Level | Description | | ----------------------------------------- | ---------------------------- | ------------------------------------------------------------------------ | | Templates (`SDOC__SDTemplate__c`) | Read | Lets community users select approved templates without editing them. | | Documents (`SDOC__SDoc__c`) | Create, Read, Update, Delete | Supports full lifecycle handling of generated document records. | | Jobs (`SDOC__SDJob__c`) | Create, Read, Update, Delete | Enables queueing and management of generation jobs from community flows. | | Relationships (`SDOC__SDRelationship__c`) | Create, Read, Update, Delete | Maintains links between generated docs and related records. | | Envelope (`SDOC__Envelope__c`) | Create, Read, Update, Delete | Supports eSignature envelope operations in community scenarios. | | Actions (`SDOC__SDAction__c`) | Read | Allows use of preconfigured package actions without modification rights. | Admin Notes * Prerequisites: Requires an Experience Cloud user license/profile setup and access to underlying business records used in merge templates. * Stacking: Usually used as the primary S-Docs set for community users; add signer-focused access only when community members must complete eSignature signing flows. * Limitations/Security Warnings: Although templates are read-only, this set still grants full CRUD on several S-Docs transaction objects; confirm external sharing rules are tightly controlled. ### SDocs User API Name: `SDOC__SDocs_User` Target Persona: Internal standard end-user Description: This set is designed for internal users who need to generate and use S-Docs from existing templates. It enables document/job operations while preventing template editing. Use this as the standard baseline for non-admin S-Docs users. Object & Feature Access | Object / Feature | Access Level | Description | | ----------------------------------------- | ---------------------------- | ----------------------------------------------------------------------- | | Templates (`SDOC__SDTemplate__c`) | Read | Users can run approved templates without altering template definitions. | | Documents (`SDOC__SDoc__c`) | Create, Read, Update, Delete | Allows full document generation and post-generation document handling. | | Jobs (`SDOC__SDJob__c`) | Create, Read, Update, Delete | Supports running and tracking document generation jobs. | | Relationships (`SDOC__SDRelationship__c`) | Create, Read, Update, Delete | Maintains document-to-record linkage data. | | Envelope (`SDOC__Envelope__c`) | Create, Read, Update, Delete | Supports eSignature envelope operations in standard user workflows. | | Actions (`SDOC__SDAction__c`) | Read | Allows use of predefined action metadata needed for generation flows. | | Help tab (`SDOC__SDHelp`) | Visible | Provides in-app help entry for S-Docs users. | Admin Notes * Prerequisites: Users need access to the base Salesforce objects/records included in templates and any required email capability for sending generated documents. * Stacking: Typical baseline for internal users; add `SDOC__SD_eSign_Requester` when the same user also needs full eSignature request management. * Limitations/Security Warnings: No template CRUD in this set, which helps reduce configuration risk for standard users. ### S-Doc Site Guest User API Name: `SDOC__S_Doc_Site_Guest_User` Target Persona: Public site guest signer/viewer Description: This set supports public-site interactions where a guest user needs limited document and envelope access. It is primarily read-only, with update on envelope records for status progression in guest flows. Use it for controlled public-facing document experiences. Object & Feature Access | Object / Feature | Access Level | Description | | ------------------------------------ | ------------ | ---------------------------------------------------------------------- | | Envelope (`SDOC__Envelope__c`) | Read, Update | Allows guest sessions to read and update envelope status-related data. | | Templates (`SDOC__SDTemplate__c`) | Read | Allows guest flows to reference approved templates only. | | Documents (`SDOC__SDoc__c`) | Read | Allows guest sessions to view necessary S-Docs records. | | Actions (`SDOC__SDAction__c`) | Read | Supports execution paths that rely on action metadata lookups. | | Template tab (`SDOC__SDTemplate__c`) | Visible | Exposes package template tab access where required by site flow/UI. | Admin Notes * Prerequisites: Must be combined with strict guest user sharing, field-level security, and site-level access controls. * Stacking: Commonly paired with `SDOC__SDocs_Jobs_Guest_Users` when both guest interaction and guest job creation are required. * Limitations/Security Warnings: **Guest-user assignment should be treated as high risk.** Validate every exposed object, field, and record path in lower environments before production rollout. ### S-Docs Minimum Access User API Name: `SDOC__S_Docs_Minimum_Access_User` Target Persona: Baseline user requiring package visibility Description: This is a minimal-footprint permission set intended to establish baseline package access without granting substantive data CRUD rights. It is useful as a foundation layer in a least-privilege model. Additional S-Docs permission sets are typically added on top based on role. Object & Feature Access | Object / Feature | Access Level | Description | | ----------------------- | ---------------------- | ------------------------------------------------------------------------------------------- | | Package baseline access | Minimal feature access | Establishes lightweight package-level access with no explicit object CRUD in this metadata. | Admin Notes * Prerequisites: Users still need normal org access to the records and features they will use outside of this baseline. * Stacking: Designed for stacking with role-specific sets such as `SDOC__SDocs_User`, `SDOC__SDocs_LWC_Community_User`, or `SDOC__SD_eSign_Requester`. * Limitations/Security Warnings: By itself, this set does not grant practical working access to core S-Docs data objects. ### S-Docs Support Admin API Name: `SDOC__S_Docs_Support_Admin` Target Persona: Admin handling support and diagnostics Description: This set is intended for admin users who troubleshoot S-Docs issues. It exposes diagnostic and support-focused package UI tabs rather than transactional document CRUD. Use it for support operations and incident triage. Object & Feature Access | Object / Feature | Access Level | Description | | ------------------------------------------------ | ------------ | ------------------------------------------------------------------- | | Diagnostic Logger tab (`SDOC__diagnosticLogger`) | Visible | Provides access to package diagnostics tooling for troubleshooting. | Admin Notes * Prerequisites: Assign to users who already have enough org visibility to investigate issues effectively. * Stacking: Commonly stacked with `SDOC__SDocs_Administrator` for full admin + support capabilities. * Limitations/Security Warnings: This set does not itself provide core S-Docs object CRUD, so support users may still need additional admin/user permission sets. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.sdocs.com/sdocs/administration/security/s-docs-permission-sets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.