Assign Second-Generation Managed Packaging User Permissions

To create second-generation managed packages and scratch orgs, developers require access to the Dev Hub org. We recommend enabling the Dev Hub in your Partner Business Org (PBO). A Salesforce admin can create a permission set to grant appropriate permissions to the required Dev Hub objects and system permission.

To give developers access to the Dev Hub org, create a permission set that contains these required permissions:

Object Settings > Scratch Org Info > Read, Create, and Delete
Object Settings > Active Scratch Org > Read and Delete
Object Settings > Namespace Registry > Read (to use a linked namespace in a scratch org)

To provide users with the ability to create second-generation managed packages and package versions, the permission set must also contain:

System Permissions > Create and Update Second-Generation Packages

This permission provides access to:

Salesforce CLI Command	Tooling API Object (Create and Edit)
`sf package create`	Package2
`sf package version create`	Package2VersionCreateRequest
`sf package version update`	Package2Version

If you choose to test your package in a scratch org, the Create and Update Second-Generation Packages permission is also required when creating the scratch org if you specified an ancestor version in the sfdx-project.json file. Alternatively, use the –noancestors flag with the sf org create command when you create the scratch org.