Permission builder
Reading access is half the job. The other half is fixing it. Compose a clean permission set or group and see exactly what it grants before anything is created.
Compose a set
Name it, then add objects and pick the access, add Apex classes, and add only the user permissions you intend. Skemia writes the metadata live: a real package.xml you can deploy.
Build a group
Combine member permission sets, mute parts of them, and preview the net effective access the group grants before you ever create it.