1. A method comprising: receiving, at one or more servers, a first request from an authorized administrator associated with a third party application to create a new permission set including one or more permissions for accessing one or more computing resources of a multi-tenant database environment implemented using a database system, the multi-tenant database environment having a plurality of tenant organizations, the new permission set having one or more permissions for accessing resources associated with the third party application, the third party application being one of a plurality of applications being implemented in the multi-tenant database environment; creating the new permission set; storing the new permission set in a database of the database system; receiving, at one or more servers, a second request to assign the new permission set to a first user associated with a first one of the plurality of tenant organizations, the first user being associated with a first user constraint defined by a first one of a plurality of user licenses available to users associated with the first tenant organization, the first user constraint defining a first group of permissions permitted to be assigned to the first user, the first user constraint being applied to other users associated with other tenant organizations of the plurality of tenant organizations; responsive to receiving the second request, automatically determining that the one or more permissions in the new permission set do not violate the first user constraint by determining that each of the one or more permissions of the new permission set exists in the first group of permissions defined by the first user constraint; and responsive to determining that the one or more permissions in the new permission set do not violate the first user constraint, automatically assigning the new permission set to the first user.