Platform Dataspace Access Configure

platform-dataspace-access-configure

Configure DataSpace access in Salesforce Data Cloud using a two-layer model:

1. DataSpace-level access — grant a PermissionSet access to a DataSpace by embedding a <dataspaceScopes> element in the permission set XML and deploying via MDAPI.
2. Object-level access (optional) — grant that permission set access to specific DMO / DLO / CIO objects within the DataSpace using the Object Access Grants Connect API.

The MDAPI layer is required to establish the PermissionSet → DataSpace linkage. The Connect API layer is optional and only needed when access should be scoped to specific objects rather than governed entirely by data governance policies.

Decide the Case First

Pick exactly one case from the table below before writing any files. Each case has a different output shape.

Only emit the files listed for the case you picked. Emitting Case A/B files for a Case C prompt (or vice versa) is a correctness failure — extra files change the deployment shape.

Case B — critical: PermissionSet MDAPI deploy is a full metadata replace. Every <objectPermissions>, <fieldPermissions>, <userPermissions>, <tabSettings>, <applicationVisibilities>, <recordTypeVisibilities>, <customPermissions>, <pageAccesses>, <classAccesses>, <customMetadataTypeAccesses>, <customSettingAccesses>, <externalDataSourceAccesses> element you omit from the redeploy is deleted from the org. Before adding <dataspaceScopes> to an existing permset, retrieve the current XML and patch it — do not hand-author from scratch.

Case B workflow

1. Retrieve the existing permission set:

   sf project retrieve start --metadata PermissionSet:<Name> --target-org <alias>

2. Open the retrieved permissionsets/<Name>.permissionset-meta.xml. Keep every element already there.
3. Insert the <dataspaceScopes> block for the target DataSpace (element order in the file does not matter for MDAPI). If the file already has a <dataspaceScopes> block for this same DataSpace, replace only that block. Leave every <dataspaceScopes> block for other DataSpaces untouched — one block per DataSpace. For a requested scope removal, remove only the matching block and deploy; omitting the block revokes that DataSpace grant. Verify by retrieving the PermissionSet and confirming the matching <dataspaceScopes> block is absent.
4. Write package.xml listing the permset in <members>.
5. Redeploy with sf project deploy start.

When This Skill Owns the Task

Trigger this skill when the user wants to:

• Create a permission set that grants access to a Data Cloud DataSpace
• Add or modify dataspaceScopes on an existing permission set
• Grant a permission set access to specific DMO / DLO / CIO objects in a DataSpace
• List which permission sets have a DataSpace scope and inspect its access levels
• Configure dataAccessLevel and objectAccessLevel for a DataSpace scope
• List or remove object access grants for a permission set + DataSpace pair

Delegate elsewhere when:

• The permission set has no DataSpace access at all → platform-permission-set-generate

Layer 1 — DataSpace-Level Access (MDAPI)

Embed a <dataspaceScopes> element inside the PermissionSet XML. Deploy with MDAPI.

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>Data Cloud Analyst</label>
    <description>Data cloud analyst access to the default dataspace</description>
    <hasActivationRequired>false</hasActivationRequired>
    <dataspaceScopes>
        <dataspaceScope>default</dataspaceScope>
        <dataAccessLevel>ALL</dataAccessLevel>
        <objectAccessLevel>BY_POLICY</objectAccessLevel>
    </dataspaceScopes>
</PermissionSet>

Element Rules

Common Mistakes

• Wrong parent name — using <dataspaceScopeAccess> instead of <dataspaceScopes>. Deployment fails silently or with cryptic errors.
• Wrong child name — using <dataspaceScopeName> instead of <dataspaceScope>.
• Wrong enum values — ViewAllRows / Read / OWNER / EDIT are not valid. Use NONE, CONTROLLED_BY_PARENT, or ALL for dataAccessLevel; use BY_POLICY or ALL_IN_DATASPACE for objectAccessLevel. See Element Rules table for allowed combinations. Deployment error -379999659 means invalid enum.
• Multiple scopes in one element — <dataspaceScopes> grants access to exactly one DataSpace. To grant access to multiple, add multiple <dataspaceScopes> blocks.

Package Layout (Case A and Case B)

A deployable bundle for Layer 1 always contains both files:

<output-root>/
  package.xml
  permissionsets/<Name>.permissionset-meta.xml

package.xml (required — list every permission set being deployed in <members>):

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Data_Cloud_Analyst</members>
        <name>PermissionSet</name>
    </types>
    <version>67.0</version>
</Package>

Deploy:

sf project deploy start --source-dir force-app/main/default/permissionsets/ --target-org <alias>

Read-Only DataSpace Scope Inspection — Case D

Use Case D when the user asks which permission sets have access to a DataSpace, or asks to inspect dataAccessLevel and objectAccessLevel without making a change.

Never query DataspaceScope or DataspaceScopeAccess with SOQL. Those objects are not a supported query surface for this relationship. Do not try SOQL as discovery, fallback, or troubleshooting.

1. Retrieve PermissionSet metadata into an isolated temporary local project and output directory. Do not retrieve into the user's existing metadata tree. Save the skill repository path first (as an absolute path if possible):

   REPO_ROOT="<absolute/path/to/sf-skills-internal>"  # or $(pwd) if you're in the repo root
   WORK_DIR=$(mktemp -d)
   sf project generate --name dataspace-scope-inspection --output-dir "$WORK_DIR"
   cd "$WORK_DIR/dataspace-scope-inspection"
    sf project retrieve start --json \
      --metadata "PermissionSet:*" --target-org <alias> \
      --output-dir "$WORK_DIR/retrieved"

   Inspect the JSON result before continuing. A nonzero command status, a failed result.status, warnings, or an unexpectedly low result.fileProperties count means the retrieve may be incomplete. Report that limitation rather than treating the result as empty, and do not fall back to SOQL.
2. Run the inspection script from the skill directory (do not rely on relative paths after cd changed the working directory). Supply the retrieved directory and optional DataSpace name:

   "$REPO_ROOT/skills/platform-dataspace-access-configure/scripts/inspect-dataspace-scopes.sh" \
     "$WORK_DIR/retrieved" "<DataSpace API name, if given>"

   Report the output to the user, one result per line.

Case D is read-only with respect to the org. Do not deploy metadata, assign a permission set, execute Apex, perform record DML, or make a POST, PUT, PATCH, or DELETE request. Do not generate package.xml, PermissionSet XML, or api-request.json in the user's workspace as part of inspection. Remove the temporary work directory after reporting: rm -rf "$WORK_DIR". The scope-level objectAccessLevel is not an inventory of explicit object grants; inspect those separately with the read-only object-access-grants endpoint only when requested.

Layer 2 — Object-Level Access (Connect API) — Case C

Only needed when objectAccessLevel is not BY_POLICY, or when governance policies do not cover the target objects. Grants are runtime — no MDAPI deploy, no package.xml, no permission set XML. The only artifact for a Case C task is a single api-request.json describing the Connect API call.