Answer
FND_RUNTIME is commonly used as the genuine baseline permission set attached to an 'all users' permission set, giving users what they need to log in and use common environment functionality. FND_ENDUSER already includes FND_RUNTIME plus somewhat broader end-user capabilities, like being able to schedule a report to run at a later time, which for most environments isn't actually problematic access to grant broadly, despite initially looking overly broad — worth double-checking whether a specific capability you're wary of, like scheduling, is actually something you'd want users to have anyway. FND_CONNECT, by contrast, is specifically meant for integration/connect-related access and isn't something a normal end user needs at all — its name is misleading about what it actually controls, and granting it broadly to all users is a common mistake worth avoiding. Functional/module-specific permission sets should be layered on top of this baseline set, rather than trying to fold module-specific access into the baseline set itself.