Permission sets add capabilities to a user's baseline. A permission set group combines several sets for a job role. Group muting removes selected permissions from that group's contribution, but it doesn't revoke a grant from a profile, an individually assigned set, or another group. Effective access is the combination of those sources.
Build a grant around a task rather than around one person. A support specialist may need read-only access to opportunities without gaining sales editing or unrestricted visibility. Define the set, assign it, then test the user's actual result. An unassigned set grants nothing. A group whose recalculation is still updating also needs attention before its expected access becomes dependable. Keep the source of each grant explainable.