Salesforce Agentforce governance guidance

Reviewed 3 October 2026. Aicura is not affiliated with Salesforce.

About Salesforce Agentforce

Salesforce Agentforce lets an organisation put AI agents to work across service, sales, field service, IT and employee support, grounded in its own CRM data and other connected data. Agents talk with customers and staff on the web, by phone and in messaging apps, and they act by running flows, code, prompt templates and connected APIs, escalating to a person when a matter needs one. Reach grows with every new agent, action and connected system, so the value comes from expanding with confidence that each agent is doing what was approved.

Where governance makes the difference

• Customers affected by decisions at scale. Agents speak directly with customers and can resolve cases or update records that touch money, access to services and employment. Without agreed limits and review, one poorly scoped instruction can repeat across thousands of conversations before anyone notices.
• Actions reaching beyond their purpose. Each action an agent can run is a capability on the organisation’s systems. An agent given broad actions or connected tools with no clear owner can end up changing records or reaching data nobody set out to allow.
• Conversation content steering the agent. Agents read what customers type and what connected systems return, so instructions hidden in that content can influence what an agent says or does with sensitive customer information.

---

For the executive team

Customer-facing agents speak for the organisation

Salesforce Agentforce agents hold conversations with customers and act on their behalf. What an agent says and does carries the same weight as a staff member doing the same work, so the organisation needs to be clear about what agents may decide alone and when a person takes over.

Every agent needs an owner and agreed limits

Each agent needs a named person accountable for it, a clear purpose and limits on the systems and decisions it can reach. Ownership matters most where agents touch customer money, eligibility or staff matters.

Oversight needs to keep pace with change

New agents, new actions and new connected systems arrive steadily, and the vendor continues to develop the AI underneath. The deployment approved at launch will not be the one running six months later, so oversight works best as an ongoing practice with clear points where significant changes come back for approval.

Questions worth putting to management

• Who is accountable for Salesforce Agentforce, and who owns each agent built on it?
• Which decisions can agents make without a person, and where does a customer reach a person?
• Is there a complete picture of every agent in use, the actions it can take and the data it reaches?
• How would the organisation know if an agent began giving wrong answers or acting beyond its purpose?
• How are new agents and changes approved before customers see them?
• If a regulator, customer or insurer asked how Salesforce Agentforce is governed, what would be shown to them?

What good reporting looks like

Expect regular reporting on which agents are live and what they handle, how often conversations pass to people and why, the quality of outcomes for customers, the main risks and how they are changing, any incidents or complaints and the significant decisions taken, with who made them and why.

How Aicura can help

• One register of Salesforce Agentforce and every agent built on it, each with an owner, an accountable executive and a record of what it can reach.
• Board reports drafted from the governance record, covering agents in use, risks, incidents and the decisions taken.
• A public trust centre where customers and partners can see how the organisation governs its customer-facing AI.

---

For risk, compliance and assurance

Set where agents sit in the risk appetite

Decide which classes of customer and staff information agents may work with and which outcomes they may decide alone. Decisions that affect a person’s money, access to a service, legal rights or employment need either a person in the loop or a clear basis for leaving one out, agreed in advance and recorded.

Assess each agent on its own terms

Assess the platform before rollout, then assess each agent separately. Cover the people it talks to, the data it is grounded in, the actions it can run, the connected systems and tools it can call, how and when it hands over to a person and who reviews its outcomes.

Reassess when anything changes

A new action, a changed instruction, a new channel, a new connected tool or a change to the underlying AI all move an agent away from what was assessed. Each needs to trigger a fresh assessment rather than wait for the annual cycle.

Make the data decisions explicitly

Agents can work with sensitive personal information drawn from customer records and conversations. Decide which data each agent may be grounded in, how long conversation records and traces are kept, who may access them and for what purpose. Check how the vendor’s terms handle data used by the AI and confirm the settings match what the organisation decided.

Be open with the people agents serve

Customers and staff interact directly with agents. Decide how people are told they are dealing with an AI, how they reach a person and how they can query an outcome, and keep those commitments consistent across every channel.

Confirm which protections apply

Check which licences, regions and configurations carry the vendor’s enterprise data commitments, and confirm that every agent and connected tool in use sits within them. Tools obtained from marketplaces or partners need their own due diligence.

Set limits and name who acts

Agree the limits that matter, such as a rise in failed or escalated conversations, an agent calling an action it was not approved for, sensitive information appearing where it should not or a sudden change in volume or cost. Name the person who acts when one is crossed and what they may do, up to taking an agent out of service.

Be ready to show governance to others

• Policy. Maintain an AI use policy that covers customer-facing agents specifically, including which decisions agents may make, how people reach a person and who may build and publish agents. Tie each commitment to the control that carries it out.
• Accountability. Record committee and management decisions with their reasons when they are made. Have agent owners confirm periodically that their agents still match what was approved.
• Operating evidence. Keep records that controls actually ran, such as agent approvals, test results before release, reviewed conversations, escalations and interventions.
• External scrutiny. Prepare for internal and external audit, certification against standards such as ISO/IEC 42001, regulator enquiries and insurer questions about AI controls.
• Customers and partners. Customers increasingly ask whether they are dealing with AI and how their information is used. Have clear answers supported by evidence.
• Incidents. Be able to reconstruct which agent version, which instructions, which actions, which data and which controls were in place when a conversation went wrong.

How Aicura can help

• Risk and impact assessments for each agent against recognised frameworks, run again on any material change and feeding a managed set of risks and controls that can mirror to the GRC platform.
• Committee decisions, policy impact reviews and owner attestations recorded against the agents they concern.
• Limits on agent activity with responses the organisation chooses, from alerting the owner and re-running an assessment to quarantining an agent.
• Incident handling linked to the agent involved, through assessment, notification drafting and a final report, with every decision kept as evidence a third party can verify.

---

For technology and security

Discover every agent and what it can call

Inventory every Salesforce Agentforce agent across production and sandbox environments, along with its channels, the actions it can run, the flows, code and APIs behind those actions and every connected tool or MCP server. Include agents from other platforms that Salesforce Agentforce coordinates, so the picture covers the whole estate.

Prepare data and permissions before agents go live

Agents are grounded in CRM data and other connected data. Review what each agent can read and change, keep the access it runs with as narrow as its purpose allows and keep the most sensitive records out of reach unless a specific agent needs them. Test with sandbox data before production.

Put agents under change control

Agents share the platform’s metadata foundation and can be built from an IDE as well as the builder, with batch testing that can run in a pipeline. Keep agent definitions and instructions in source control, deploy through a pipeline and run a preflight check on every deployment, so a new agent, action, connected tool or channel is checked against agreed rules before it goes live.

Control who can build, publish and connect tools

Limit who can build and publish agents and who can add actions or connected tools. Use the platform’s registry, approval and allowlisting for MCP servers so only approved tools are available, and review each new tool’s data access before it is switched on.

Rely on vendor controls and observation for the AI leg

The agent’s reasoning and its calls to the AI run within the vendor’s cloud, so that leg cannot be routed through the organisation’s own AI gateway. Rely instead on vendor settings, careful scoping of actions and data, observation of every session and contract terms. Endpoints the organisation hosts for agents to call can still sit behind its own network and access controls.

Feed session traces into monitoring

The product offers session tracing, analytics and alerts, and its session trace data can be integrated with existing monitoring tooling. Bring that data into central monitoring, check tool and action calls against what each agent was approved to do, apply the limits risk has agreed and set responses ranging from alerting the owner to restricting or stopping an agent.

Test agents against the live deployment

Run multi-turn simulations and evaluations before release, and red-team agents on a schedule afterwards against the deployed agent with its real actions and data, including attempts to steer it through conversation content. Where changes are trialled with traffic splits, apply the same tests to each variant and watch for changes in behaviour between runs.

How Aicura can help

• One inventory of Salesforce Agentforce agents with the actions, tools, models and identities behind each, plus discovery of AI not yet recorded.
• Preflight checks in the deployment pipeline before an agent, action, tool or model goes live, with every answer recorded.
• A collector inside the network for session traces and agent decision records that flags tool calls an agent was never declared to make and holds readings against agreed limits.
• Scheduled red-teaming, evals and agent evals against the live deployment from inside the environment, with drift watched between runs.

---

Getting lasting value from Salesforce Agentforce

Salesforce Agentforce pays off when it is governed as an ongoing practice rather than approved once at launch. Three things matter whatever the role. The first is knowing every agent in use, what it can do and who is accountable for it. The second is keeping permissions, controls and assessments in step as agents, actions and connected tools grow. The third is being able to show, at any time, how decisions about customers were made and that controls held. Organisations that get these right can hand more work to agents with confidence rather than caution.

---

Sources

• Salesforce, Agentforce
• Salesforce, Agentforce Builder
• Salesforce, Agent Development Lifecycle
• Salesforce, Agentforce Observability
• Salesforce, Agentforce MCP Support
• Salesforce, Agent Script