Trust — Patterns

The Trust pillar focuses on security, compliance, data protection, identity and access management, incident response, and shared responsibility between you and Salesforce. These patterns turn the pillar’s design principles into concrete, reviewable practices: what to look for in a solution, what good looks like, and the anti-patterns that undermine it.

These patterns put the Trust pillar’s design principles into practice. Read them alongside the Trust pillar for the full guidance behind each one.

  • Apply zero trust across all layers — verify every access request explicitly rather than trusting it for its network location or origin.
  • Grant least privilege by default — start from the most restrictive access and expand deliberately based on documented business need.
  • Implement defense in depth — layer preventive, detective, and responsive controls so failure of one doesn’t compromise the system.
  • Integrate security by design — build threat modeling and security requirements into every architecture phase, before build begins.
  • Embed security in automation — build security controls into CI/CD pipelines, configuration-as-code, and platform defaults.
  • Design for privacy — architect for data minimization, purpose limitation, consent management, and data-subject-rights workflows.
  • Design for traceability — make every consequential action attributable and reconstructable through preserved, tamper-resistant audit trails.
  • Design for incident response — design for detection, real-time intervention, recovery, and response procedures you have tested.

Each category pairs patterns (what good looks like) with anti-patterns (what to avoid), organized so you can review a solution area by area. Start from the trust outcome you need:

  • Establishing who can access what? Use Identity and Access Management for authentication, authorization, MFA, OAuth, and session management.
  • Protecting sensitive data? Use Data Protection and Privacy for encryption, field-level security, data residency, and privacy controls.
  • Meeting regulatory obligations? Use Compliance and Regulatory for audit trails, certifications, and governance.
  • Detecting and responding to threats? Use Incident Response and Security Operations for security monitoring, event detection, and response.
  • Building security into the pipeline? Use Secure Development Lifecycle for shift-left security, OWASP Top 10 defenses, and security testing.
  • Clarifying who owns which control? Use Shared Responsibility to divide security duties between platform features and your implementation.
  • Operating agents in production? Use Agentic Patterns for prompt injection defense, model monitoring, and secure agent-to-agent communication.

Trust-specific patterns for agentic systems including prompt injection defense, model monitoring, and secure agent-to-agent communication.

Patterns for regulatory compliance, audit trails, certifications, and governance.

Patterns for data encryption, field-level security, data residency, and privacy controls.

Patterns for authentication, authorization, MFA, OAuth, and session management.

Patterns for security monitoring, event detection, incident response, and security operations.

Patterns for shift-left security, OWASP Top 10 defenses, secure pipeline design, and security testing.

Patterns clarifying security responsibilities between platform features and architect implementation.