Salesforce recommends creating dedicated integration users and granting each integration only the access required for its system-to-system operations. This implements least privilege, provides clearer transaction traceability, and limits exposure if integration credentials are compromised.

The integration user's base profile should remain deliberately restrictive. Additional object, field, API, and functional access should be granted through permission sets and permission set groups. Salesforce explicitly recommends permission sets and permission set groups for extending access rather than using profiles as the primary mechanism for accumulating job-specific permissions.

Because this ERP integration must write to a custom object, the consultant can create a permission set that supplies the necessary Create/Edit and field permissions for that object, along with any other permissions required by the integration. The permission set can then be included in a permission set group when multiple integration capabilities must be combined.

Using a System Administrator account violates least-privilege principles and unnecessarily exposes the org. Expanding the integration profile directly also makes access more difficult to manage modularly.

Study Guide references/topics: Configure and Build — Third-Party Integrations; Integration Users; Permission Sets; Permission Set Groups; Least-Privilege Security.