<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>ConsultingCloud Audit ReadOnly</label>
    <description>Read-only access for the consultingcloud.io Salesforce architecture audit. Grants exactly four permissions: API access, visibility of setup/configuration metadata, user list, and the role hierarchy. No object create/read/edit/delete, no Modify All Data, no View All Data — the audit reads configuration metadata only, never business records. Assign to a dedicated user on the Minimum Access profile; deactivate that user when the engagement ends. Details: https://consultingcloud.io/request-audit.html</description>
    <hasActivationRequired>false</hasActivationRequired>
    <userPermissions>
        <enabled>true</enabled>
        <name>ApiEnabled</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewSetup</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewAllUsers</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewRoles</name>
    </userPermissions>
</PermissionSet>
