Sharing to help others:

Tested On:  SharePoint/Nintex 2016, on premise

Tested using account that is farm / site collection admin (full permissions).

I discovered an issue when trying to restrict a Document Set to specific permissions groups, and after much testing, found a way that works. Apparently the “remove existing permissions” check box doesn’t work where the inherit permissions was previously removed.

The Set Permissions workflow runs on New or Modified items when the Business Unit Previous does not equal the Business Unit.

After the first run, changing the Business Unit left the previous Business Unit permissions group on the document set, while adding the new Business Unit permissions group.

The fix was to insert a Set Permissions block to Inherit the permissions from the parent library. Then do a second Set Permissions block to set to the new Business Unit permissions group.

Build a string to set a variable for the permission group name that is using Item Property of Business Unit.

The permissions blocks with Commit pending changes block in the middle;

First, Set item permissions to Inherit permissions from parent.

Second, Set Item permissions to the required groups, one of which is the variable.