Universal Containers has two types of applicants: Hourly and Salary.

A permission set is the appropriate way to selectively grant the Salary record type to the hiring manager and VP of HR while other HR users retain ordinary access to applicant records. Salesforce explicitly supports assigning custom record types through permission sets. The base profile can provide the common Applicant object permissions and Hourly record type, while the additional permission set expands Salary record-type availability only for authorized users. This separates record creation capability from record-level visibility. Changing organization-wide defaults would unnecessarily affect who can view applicant records and does not control record-type selection. Simply making Hourly the default also does not prevent users from choosing another record type if they have access to it. Object-level Create permission cannot distinguish between two record types of the same object. Therefore, D provides the required granular access.

================