Trust Agentic Enterprise - Patterns

Learn more about Well-Architected Trust → Agentic Enterprise Trust

Patterns

Where to look	What good looks like
Agentforce \| Agent Configuration	✅ Create integration user “Agent_Product_Support” with permission set granting Read on Case/Product, access to Knowledge articles, and specific Actions for case updates only
Agentforce \| Agent Configuration	✅ Configure running user with minimum permissions required for the agent’s defined scope
Platform \| Permission Sets	✅ Create purpose-built integration users for agent contexts and grant permission sets providing exactly what the agent requires
Platform \| Event Monitoring	✅ After deployment, use Event Monitoring to identify granted permissions never exercised at runtime and remove them; Setup Audit Trail records the configuration changes (grants and revocations), not which permissions are actually used

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Configuration	⚠️ Assign System Administrator as running user because it “just works” and avoids permission errors during testing
Platform \| Org	⚠️ Allow agents to retain broad permission sets that were granted during development without post-deployment review

Patterns

Where to look	What good looks like
Agentforce \| Agent Builder	✅ Treat subagent and action configuration in Agent Builder as a permission boundary, not just routing — if an action isn’t assigned to a subagent, the agent can’t invoke it
Agentforce \| Agent Builder	✅ Remove subagents exposing capabilities the agent doesn’t need (an agent that answers product questions shouldn’t have record modification, email sending, or flow invocation in scope), and review subagent scope when responsibilities change
Platform \| Apex	✅ Verify every Apex action in the agent’s action set uses with sharing or inherited sharing unless system context is deliberate and documented, so the running user stays the security boundary
Agentforce \| Action	✅ Validate tool outputs against a schema before the agent processes them, treating every tool response as untrusted input
Agentforce \| Action	✅ Constrain tool parameters to allowed value ranges (e.g., validate recipient domains on a send-email action) rather than letting agent reasoning on untrusted data determine them
Agentforce \| Action	✅ Enforce tool-level permission checks at the tool implementation layer, not only in agent configuration, so a capability verifies its calling context before executing
Agentforce \| Action	✅ Use named credentials for all external callouts from agent actions

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Builder	⚠️ Leaving subagents that expose record modification, email sending, or flow invocation on an agent designed only to answer product questions
Agentforce \| Agent Builder	⚠️ Treating agent configuration as routing-only without recognizing that anything listed is reachable through prompt manipulation, even capabilities the agent wasn’t designed to use
Platform \| Apex	⚠️ Adding a custom Apex action running in system mode (without sharing) that bypasses the running user’s field-level security and sharing rules without deliberately designing for it
Agentforce \| Action	⚠️ Processing tool responses as trusted input without schema validation, letting malformed or injected data reach agent reasoning

Patterns

Where to look	What good looks like
Agentforce \| Agent Configuration	✅ Document permission chain: Order Orchestrator (Read Orders, Write Order Status) → Inventory Specialist (Read/Write Inventory) → Shipping Specialist (Create Shipping). Verify user context permits all downstream operations
Agentforce \| Agent Configuration	✅ Map effective permissions of the complete orchestration chain before deployment
Agentforce \| Agent Configuration	✅ Design permission boundaries across the full workflow, not just individual agents

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Configuration	⚠️ Allow orchestrator with limited permissions to invoke specialist with Modify All Data, bypassing orchestrator’s restrictions
Agentforce \| Agent Configuration	⚠️ Evaluate individual agent permissions without mapping the effective privilege of the entire orchestration chain

Patterns

Where to look	What good looks like
Agentforce \| Prompt Template	✅ Separate instructions from data architecturally: system-level instructions must not be mixed with record-sourced content, user-supplied text, or tool responses through string concatenation
Agentforce \| Action	✅ Identify Case Description, Email Body, Chat Transcript as high-risk fields. Implement preprocessing layer that summarizes content before passing to agent reasoning, stripping potential injection instructions while preserving meaning
Agentforce \| Agent Configuration	✅ Define input validation contracts at every agent boundary and treat every external content source as untrusted
Data 360 \| Grounding Sources	✅ Treat Knowledge articles, Data 360 indexed documents, and external retrieval sources as persistent injection surfaces requiring ongoing review
Einstein \| Trust Layer	✅ Treat Einstein Trust Layer security controls as one layer in defense-in-depth, not complete solution

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Prompt Template	⚠️ Concatenate raw Case Description into agent prompt with system instructions, assuming model will distinguish case content from attack instructions
Data 360 \| Grounding Sources	⚠️ Trust grounding sources without considering that adversarial content persists and can be modified over time by parties without direct agent access
Einstein \| Trust Layer	⚠️ Rely exclusively on Trust Layer security controls without additional architectural defenses for novel injection techniques

Patterns

Where to look	What good looks like
Einstein \| Trust Layer	✅ Agent retrieving case information queries only fields needed for reasoning (Case Number, Product, Status, Priority) rather than all Case fields. PII masking provides additional protection if unexpected PII appears
Einstein \| Trust Layer	✅ Configure Trust Layer appropriately and document data flows through Trust Layer processing
Einstein \| Trust Layer	✅ Determine which data classifications can enter LLM inference for your regulatory context
Platform \| Event Monitoring	✅ Route Trust Layer audit events to SIEM alongside Event Monitoring data
Platform \| Event Monitoring	✅ Implement application-level logging capturing what agent decided, what action it took, and what business outcome resulted alongside Trust Layer logs
Business \| Documentation	✅ Validate Trust Layer audit retention meets regulatory requirements

Anti-Patterns

Where to look	What bad looks like
Einstein \| Trust Layer	⚠️ Query all Case fields including sensitive notes and payment information, relying on PII masking to strip everything problematic
Einstein \| Trust Layer	⚠️ Design agents to send full record context to LLM inference assuming PII masking handles everything
Einstein \| Trust Layer	⚠️ Treat Trust Layer PII masking as substitute for data minimization rather than as defense-in-depth

Patterns

Where to look	What good looks like
Agentforce \| Agent Configuration	✅ Order Fulfillment Specialist validates orchestrator-provided order data includes required fields (Order ID, Customer ID, Product SKU), values are within expected ranges (quantity > 0, price > 0), and order status permits fulfillment before executing
Agentforce \| Agent Configuration	✅ Define explicit typed interface contracts for inter-agent communication with structured, scoped, validated data
Agentforce \| Agent Configuration	✅ Design each agent in multi-agent workflow to validate context it receives before acting, regardless of caller identity
Agentforce \| Agent Configuration	✅ Treat inter-agent message content with same scrutiny as external user input
Integration \| External Services	✅ For agents invoking external AI services or third-party agents outside Salesforce, apply zero-trust principles and validate responses fall within expected structure and scope

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Configuration	⚠️ Specialist directly executes any action requested by orchestrator without validating request structure, values, or authorization context
Agentforce \| Agent Configuration	⚠️ Orchestrators pass raw instruction strings that specialists treat as authoritative directives
Agentforce \| Agent Configuration	⚠️ Pass full execution context, user session data, or accumulated reasoning trace to each downstream agent
Integration \| External Services	⚠️ Act on external agent responses that instruct your orchestrator to perform actions outside current task scope without rejection or escalation

Patterns

Where to look	What good looks like
Platform \| Flow	✅ Refund Agent configured with Flow checkpoint requiring human approval before any refund over $1,000 executes, regardless of agent confidence. Checkpoint implemented outside agent reasoning
Platform \| Flow	✅ Implement HITL checkpoints as workflow gates outside agent reasoning loop, designed as architectural controls rather than agent instructions
Business \| Documentation	✅ Define categories of actions requiring human confirmation: irreversible actions, actions above financial thresholds, actions communicating externally, actions involving regulated data, actions where errors have been observed
Agentforce \| Agent Configuration	✅ Design review interfaces surfacing proposed action, data agent used to reach proposal, and reasoning path where available
Platform \| Audit	✅ Store review decision with agent action record: who reviewed, when, what information shown, what they decided

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Configuration	⚠️ Configure agent with instruction “Ask for approval before issuing refunds over $1,000” assuming instruction cannot be overridden by prompt injection
Agentforce \| Agent Configuration	⚠️ Implement HITL as agent instructions that can be interpreted and potentially disregarded, rather than as workflow checkpoints outside the reasoning path
Business \| Process	⚠️ Present human reviewers with approval requests lacking context about proposed action, data used, or reasoning path — providing no genuine oversight

Patterns

Where to look	What good looks like
Platform \| Event Monitoring	✅ Route Event Monitoring and Trust Layer events to SIEM for centralized security monitoring
Platform \| Transaction Security	✅ Configure Transaction Security policies with real-time evaluation including blocking and notification capabilities
Agentforce \| Agent Configuration	✅ Implement custom application logging capturing reasoning summaries, tool invocations, and validation failures
Platform \| Event Monitoring	✅ Design alert rules detecting agent-specific suspicious patterns: bulk data access outside expected windows, invocation of actions not aligned with purpose, repeated validation failures, anomalous orchestration patterns
Agentforce \| Agent Configuration	✅ Track typical action invocation patterns, data access volumes, inference call rates, error rates, and execution times per agent to establish behavioral baselines
Platform \| Event Monitoring	✅ Define agent-specific security events: permission boundary violations, repeated validation failures, orchestration anomalies, confidence threshold breaches, fallback activation patterns

Anti-Patterns

Where to look	What bad looks like
Platform \| Event Monitoring	⚠️ Apply human activity monitoring patterns to agents without establishing agent-specific behavioral baselines
Platform \| Event Monitoring	⚠️ Rely only on signature-based detection without behavioral monitoring that can detect novel attacks
Platform \| Event Monitoring	⚠️ Ignore elevated error rates, repeated validation failures, or anomalous orchestration patterns as normal agent behavior

Patterns

Where to look	What good looks like
Platform \| Audit	✅ For each significant agent action, capture: agent identity and running user context, triggering event, data retrieved for grounding, reasoning summary, specific action and outcome, confidence level, human review decision if applicable
Platform \| Audit	✅ Implement application-level audit logging for business context that platform logs (Event Monitoring, Trust Layer events) don’t include
Platform \| Audit	✅ Route Event Monitoring and Trust Layer events to long-term storage beyond native retention periods
Agentforce \| Agent Configuration	✅ Log agent identity at each step in multi-agent execution trace for attribution through orchestration chains
Agentforce \| Agent Configuration	✅ Capture and surface reasoning summaries identifying key factors influencing agent’s recommendation for high-impact decisions
Business \| Documentation	✅ Design agent workflows so users can request explanations for decisions affecting them

Anti-Patterns

Where to look	What bad looks like
Platform \| Audit	⚠️ Rely on reconstructing what agent did from side effects in records — by the time you need audit trail, records may have changed
Platform \| Audit	⚠️ Log multi-agent workflows without identifying which specific agent performed which action in the chain
Business \| Process	⚠️ Deploy agents making high-impact decisions without capturing reasoning summaries or providing explanation mechanisms to affected users

Patterns

Where to look	What good looks like
Agentforce \| Agent Instructions	✅ When a new constraint appears mid-decision (deadline, budget, staffing, license), re-run the full trade-off across all original factors rather than letting the new input reverse the prior decision on its own
Agentforce \| Agent Instructions	✅ State the change in objective explicitly — surface when the optimization target shifts from “architecturally sound and maintainable” to “deliverable under the constraint” — so the human can see what is now being optimized for
Business \| Process	✅ Treat an architecture-versus-delivery tension as a human-owned trade-off: present what is gained (speed) against what is paid (total cost of ownership, maintainability, lock-in) and route the decision to the accountable owner
Agentforce \| Agent Instructions	✅ Keep architectural fit (does the design serve the requirements) and delivery feasibility (can this team ship it in time) as separate, visible factors rather than collapsing them into a single answer
Platform \| Documentation	✅ When reversing a documented decision, re-weigh it against the original rationale and record the reversal as a transparent, time-bound trade-off with a revisit trigger — an updated decision record shows the trade-off was re-weighed, not merely replaced

Anti-Patterns

Where to look	What bad looks like
Agentforce \| Agent Instructions	⚠️ Letting a single new constraint (team unavailable, tight deadline) reverse a technical decision while silently dropping the cost and maintainability factors that drove the original choice
Agentforce \| Agent Instructions	⚠️ Shifting the optimization goal from “architecturally sound and maintainable” to “deliverable under the constraint” without flagging that the objective changed
Business \| Process	⚠️ Reversing away from a sound design to a cheaper or more expedient option under a new constraint, without re-surfacing the long-term total cost of ownership, maintainability, and lock-in that drove the original choice
Business \| Process	⚠️ Resolving an architecture-versus-delivery conflict inside the agent’s reasoning instead of escalating it as a conscious, human-owned trade-off
Platform \| Documentation	⚠️ Producing a new decision record that logs the reversal but does not re-weigh it against the original rationale — honoring the revisit trigger in letter but not in substance

Patterns

Where to look	What good looks like
Business \| Documentation	✅ Track regulatory developments in jurisdictions where solutions operate and design compliance into agentic systems from the beginning
Business \| Documentation	✅ Assess AI system risk levels per applicable frameworks (EU AI Act, US AI Bill of Rights, regional frameworks)
Agentforce \| Agent Configuration	✅ Implement transparency and explainability mechanisms and design human oversight appropriate to risk level
Business \| Documentation	✅ Document how each industry-specific requirement (HIPAA, DORA, SOX, GDPR, CCPA) is met through specific architectural controls
Business \| Documentation	✅ Validate compliance before production deployment

Anti-Patterns

Where to look	What bad looks like
Business \| Process	⚠️ Retrofit transparency, explainability, and human oversight after deployment instead of building them in from the start
Business \| Process	⚠️ Deploy agents processing PHI, financial data, or personal data without validating they meet HIPAA, DORA/SOX, or GDPR/CCPA requirements
Business \| Process	⚠️ Ignore emerging AI-specific regulations (EU AI Act risk categorization, transparency requirements), treating them as agentic-only when traditional Salesforce automation is not exempt either

Patterns

Where to look	What good looks like
Platform \| AgentExchange	✅ Before enabling third-party action for agent use, review what action does at code and data flow level, what external services it calls, and what data it transmits
Platform \| AgentExchange	✅ Revisit third-party action configurations when managed package updates are applied
Agentforce \| Prompt Template	✅ Review prompt templates sourced outside your team before use and treat them as code executing inside privileged reasoning process with access to your org’s data
Agentforce \| Prompt Template	✅ Establish review and approval process for templates used in production agents and maintain record of template provenance
Agentforce \| Agent Configuration	✅ Maintain test suite for Customer Service Agent with representative questions, edge cases, and known injection attempts. Run suite in sandbox after model update notification, compare response quality and safety before promoting to production
Agentforce \| Agent Configuration	✅ Treat model version changes as deployment events and maintain behavioral test suites for agents covering representative inputs, edge cases, and known adversarial patterns

Anti-Patterns

Where to look	What bad looks like
Platform \| AgentExchange	⚠️ Enable third-party AgentExchange actions for agent use without reviewing code, data flows, and external service calls
Agentforce \| Prompt Template	⚠️ Use prompt templates from external sources or community examples without reviewing for embedded instructions that could modify agent safety behavior or introduce reasoning biases
Agentforce \| Agent Configuration	⚠️ Allow automatic model updates to production agents without validation, discovering behavior changes through user complaints