The permission sets defined for your organization.

Each entry carries its grants and a user_count of the enabled members currently assigned to it, so a UI can show “applied to N users”. Builtins (read-only, standard, admin) sort first and are marked is_builtin.

Reading a set needs users:read, NOT settings:read — the create-user form is open to anyone with users:create and has to populate its picker, and listing carries no privilege beyond seeing names. Creating or changing a set is the asymmetric half: that needs settings:write.