Permission Sets are the appropriate mechanism for granting additional object and field access to users who perform a particular function without changing their base profiles. The app builder can create a permission set for hiring managers that grants the required access to JobApplication__c and Read access to the sensitive salary fields through field-level security. Salesforce specifically recommends permission sets and permission set groups rather than profiles for extending field permissions. Sharing Rules and organization-wide defaults govern record-level access; they do not make fields visible when field-level security hides them. Page Layouts control which fields are placed in the interface but cannot override field-level security. Because salary information represents restricted field-level data that only a designated functional group should see, Permission Sets provide the precise least-privilege solution.

================