Yes, Salesforce Agentforce can expose customer data. An Agentforce agent inherits permissions, reads and writes CRM records, runs Flows and actions, and calls external systems, so any weak link in that chain can leak data or overstep a user’s authorization. Governing Agentforce means inspecting what the agent actually does at each step of the execution path, not just the network around it.

Last updated: July 2026.

Salesforce Agentforce lets teams build autonomous agents that reason over CRM data, invoke actions, and respond in employee and customer channels (Salesforce, 2026). Evaluate the risk across seven control points: identity, data, intentions, conversations, tools, actions, and evidence. That autonomy is the point, and it is where the control problem changes. A chatbot answers a question. An agent decides which records to read, which tool to call, and which action to take next.

The pressure points are predictable: over-permissioned agents, untrusted field data, external APIs, and citizen-built agents that never entered security review. This guide maps those risks and gives Salesforce administrators, security architects, and application owners a working evaluation path from design through audit.

How Agentforce Expands the Attack Surface Beyond a Chatbot

An Agentforce agent does not just answer. It plans a sequence of steps, reads records, calls Flows and Apex actions, and reaches connected systems, often without a human approving each step. Every step is a place customer data can move somewhere it should not.

Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, driven in part by inadequate risk controls (Gartner, 2025). The Cloud Security Alliance found that many organizations have unknown AI agents running in their environment (Cloud Security Alliance, 2026). For Agentforce, the takeaway is direct: a permitted agent inside a permitted workflow can still perform an impermissible interaction, such as reading a field it should not surface, or emitting a record into a reply bound for the wrong channel. A destination control confirms the connection. It misses the record, channel, tool, and policy context that make the interaction unsafe.

The risk extends past Agentforce’s own model. Indirect prompt injection uses data the agent reads, such as a Web-to-Lead form field, a case comment, or an email body, to carry instructions the agent then executes. OWASP ranks prompt injection as a top risk for AI model applications (LLM01) alongside sensitive information disclosure (LLM02) and excessive agency (LLM06) (OWASP, 2025). Public research has demonstrated this path against Agentforce: malicious instructions embedded in CRM-stored customer data were processed by the agent and used to move sensitive records, later remediated by tightening Trusted URL enforcement.

Permission Inheritance, Scope Sprawl, and Shadow Agents

Least privilege for AI agents means an agent holds only the object, field, and record access its task requires, and nothing it accumulated along the way. In many Agentforce configurations, agents act within an assigned user or permission-set context, so their reach depends on the permissions behind them (Salesforce, 2026). Scope sprawl sets in fast: an agent built for a narrow lookup gets bolted onto new use cases, gains more actions, and ends up with read access across a large share of the CRM.

Agentforce also lowers the bar to build. A sales-ops admin wires up a citizen-built agent to speed a workflow, and it never lands in a security review. The Cloud Security Alliance reports that 92% of organizations say legacy identity and access management (IAM) cannot manage AI and non-human-identity risk on its own (Cloud Security Alliance, 2026). IAM governs identity lifecycle and entitlement assignment. The remaining control point is the action the agent attempts with those entitlements.

Scope identity first in your IAM and identity governance and administration (IGA) platform. Okta, Microsoft Entra, and SailPoint own identity lifecycle, entitlements, and token issuance. Aurascape discovers AI apps, accounts, local AI agents, and AI interactions across network, endpoint, and API planes. That gives security teams a current view of AI activity around Salesforce workflows, while Salesforce and IAM remain the systems of record for org configuration and identity (Aurascape, 2026).

The Einstein Trust Layer, Content Security Policy, and the Shared Responsibility Boundary

Salesforce provides platform controls for Agentforce, including the Einstein Trust Layer for data masking, secure data retrieval, grounding, and toxicity detection (Salesforce, 2026). These controls matter, and you must configure them correctly. They also have a boundary: masking, grounding, and toxicity detection apply to the model interaction inside Salesforce and do not follow customer data once it leaves through an integration, a connected API, or a browser session on an endpoint.

Review four areas inside the Trust Layer and Content Security Policy (CSP) configuration:

1. Trusted URLs and CSP allowlists. Audit every whitelisted domain. Expired or overly broad entries can become exfiltration paths when an agent handles customer data.
2. Change ownership. Assign a named owner to each Trusted URL entry and require review before any third-party script destination is added.
3. Trust Layer scope. Masking, grounding, and toxicity detection apply to the model interaction inside Salesforce. They do not travel into external APIs, connected plugins, or endpoint browser sessions. Those paths need controls that follow the interaction.
4. Channel context. An agent serving both an internal service rep console and an external customer portal can surface data meant for one audience to the other. Validate the channel scope of each agent topic and action.

Native controls are strongest inside the Salesforce platform. When an agent sends data to an external API, plugin, browser session, or endpoint workflow, teams need controls that follow the interaction across that execution path. Aurascape is additive to Salesforce platform controls and to an existing SSE, SASE, CASB, data loss prevention (DLP), or secure web gateway (SWG) stack, with no rip-and-replace.

Governing the Tool-Call Execution Path, Integrations, Source Code, and Secrets

The riskiest moment is not the agent reading a record. It is the agent taking an action: calling an external API, invoking a Flow, or executing a tool that moves data. This is the tool-execution channel, distinct from the intelligence channel where the model reasons. Model Context Protocol (MCP) is one common tool-execution pattern, not the whole agent access-control problem; Agentforce actions, Flows, and connected APIs all fall along the same execution path.

Before an agent invokes an external integration, confirm five things: the integration owner is identified, the data scope the integration can receive is bounded, allowed methods are documented, failure behavior is defined so a broken integration does not silently succeed with partial data, and Salesforce Agentforce secrets are stored and rotated through a secrets manager rather than embedded in a Flow or configuration record. ISACA finds that 90% of organizations report employees using AI tools, while only 38% have a formal, comprehensive AI policy in place (ISACA, 2026). An integration checklist before agent launch closes that policy gap at the tool level.

Implementation teams should extend the same review to Apex actions, Flow metadata, packaged components, CI/CD pipelines, and secrets used by connected actions. Do not let an agent action inherit repository access, deployment credentials, or API secrets its task does not require. Salesforce Agentforce source code, deployment metadata, and packaged actions are part of the attack surface: a coding assistant or agent with access to a project can leak proprietary logic or credentials the same way it can leak a customer record.

Aurascape governs the tool-execution path inline. The Zero-Bypass MCP Gateway cryptographically signs approved tool calls and blocks unsigned ones, governing the agent-to-tool execution path at the moment of execution. Paired with local agent discovery and policy, that addresses the confused-deputy pattern, where an over-trusted agent is tricked into using its credentials on an attacker’s behalf. Data protection runs inline with 600+ real-time data classifiers that classify personally identifiable information (PII), protected health information (PHI), financial, and proprietary data during the interaction, so policy can act before the record leaves the org. Context-aware policy actions include allow, coach, warn, block, and redact, applied per interaction rather than per connection (Aurascape, 2026).

Monitoring Agent Behavior, Audit Logs, and Compliance

Monitoring Agentforce in production takes more than a single event log. Check the Salesforce Agentforce audit logs for which records an agent read and which actions it completed, plan traces that show the agent’s decision steps, alerts on unexpected action paths, abnormal record volume for a given agent, and integration call frequency that runs outside the agent’s normal pattern. A citizen-built agent suddenly calling an external API hundreds of times an hour is a signal worth a circuit breaker.

Compliance reviews under GLBA, HIPAA, or the EU AI Act require more than a connection log. A reviewer needs to know who invoked the agent, from which account and channel, what customer data it touched, which tool or action ran, and what policy decision applied. The World Economic Forum reports that organizations assessing AI-tool security before deployment nearly doubled from 37% to 64% (World Economic Forum, 2026). Audit evidence that supports reviews under those regimes requires an interaction record, not a configuration snapshot.

Aurascape produces interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy. That interaction record supports GLBA, HIPAA, and EU AI Act reviews by capturing who acted, which account and channel, what data was involved, which tool ran, and which policy decision applied. For an Agentforce action that reads a case and calls an external API, that record ties identity, data classification decision, intent, tool, and outcome together as audit evidence.

A Deployment Evaluation Path: Design, Configure, Test, Govern, Monitor, Audit

Work this sequence before an Agentforce agent touches a customer record in production. It follows the same seven control points named in the intro: identity, data, intentions, conversations, tools, actions, and evidence. For related agent-security context, the Manus AI security and compliance risks guide covers the same execution-path concerns for a different agent.

1. Design for least privilege. Scope each agent to the minimum object, field, and record access for its defined task in your IAM and Salesforce permission sets.
2. Configure platform controls. Enable and configure the Einstein Trust Layer. Review and tighten all Trusted URL and CSP entries, expire unused domains, and assign change owners.
3. Test for injection. Treat untrusted fields, such as Web-to-Lead forms, case comments, and email bodies, as injection vectors and run adversarial tests before launch.
4. Inventory every integration and pipeline. Document each Flow, action, external API, third-party plugin, Apex component, and CI/CD pipeline the agent can invoke. Confirm owner, data scope, allowed methods, failure behavior, and secrets handling.
5. Discover shadow agents. Run discovery across network, endpoint, and API planes to surface citizen-built and unregistered agents that never entered IAM or security review.
6. Add inline governance. Apply interaction-level data classification and tool-call controls so risky interactions are blocked or redacted before execution rather than flagged after the fact.
7. Monitor and audit. Review execution logs and plan traces for anomalous record volumes, unexpected integrations, and policy decisions. Map interaction records to applicable compliance obligations before an audit request arrives.

Frequently Asked Questions

Can Salesforce Agentforce expose customer data?

Yes, when it is misconfigured or over-permissioned. Weak permission scoping, injection through untrusted fields, or a misconfigured Trusted URL can each move customer data somewhere it should not go. Inline inspection of each interaction cuts that risk before the data reaches an external destination.

How can an Agentforce agent overstep user permissions?

An agent runs under an assigned user or permission set and inherits that reach. If the permission set is broader than the task, or the agent accumulates actions over time through scope sprawl, it can access objects and fields the invoking user never needed. Least privilege in your IAM and Salesforce permissions is the first control.

What is indirect prompt injection in Agentforce?

It is a malicious instruction hidden inside data the agent later processes, such as a Web-to-Lead form field or a case comment. When the agent reads that record, it acts on the injected instruction. OWASP ranks this class of attack as a top risk for AI model applications.

Does the Einstein Trust Layer make Agentforce fully secure?

No single control makes an agent fully secure. The Trust Layer provides masking, grounding, and toxicity detection inside Salesforce, and you should configure it. Under the shared responsibility model, you still own permission design, integrations, and channels, and those controls do not follow data once it leaves the platform.

How do I find shadow or citizen-built Agentforce agents?

Use discovery that spans network, endpoint, and API planes rather than the IAM registry alone. Aurascape discovers AI apps, accounts, local AI agents, and AI interactions in those environments, so teams see unregistered AI activity before it causes a data or policy problem.

Does Agentforce retain or train on my customer data?

This article does not assert Salesforce retention or training terms; your Salesforce configuration and agreement govern those, and you should confirm them in current Salesforce documentation. Independent of vendor terms, inline classification at the interaction layer lets you control what sensitive data reaches an agent or an external tool in the first place.

What audit logs do I need for Agentforce compliance?

You need a record of who invoked the agent, which account and channel, what data it touched, which tool it called, and what policy decision applied. Aurascape produces those interaction records under RBAC, giving compliance teams audit evidence that goes beyond connection logs or configuration snapshots.

Aurascape helps teams deploy Agentforce with interaction-level control across customer data, permissions, actions, tool calls, and audit evidence, while Salesforce and IAM remain the systems of record for platform configuration and identity.

See how Aurascape governs your Agentforce deployment →