Salesforce wants any agent working anywhere to access the data and workflows within Salesforce. My colleague Jason Andersen covered that push in his Dreamforce 2026 recap. He walks through Salesforce showing up in Anthropic’s Claude and Slack, its new named agents, and its first CRM reasoning model. He backs Salesforce’s bet on agents as infrastructure, then closes by pointing to two things Salesforce still has to prove. One, agents have to pay off beyond Salesforce’s core applications. And two, buyers need a reason to make Salesforce the core infrastructure for their agents instead of a big cloud provider. I read that second one as a governance question. An agent that can change a customer record needs firm limits on what it can see and do. Salesforce is building its answer on the customer data and permissions that companies already keep in Salesforce.
Salesforce’s AI harness is designed so that a company sets agent rules once
Salesforce introduced its Trusted Enterprise AI Harness just ahead of Dreamforce. It describes the harness as a set of shared capabilities that sit underneath a company’s agents. The harness is designed so companies don’t have to build data connections, controls, and security rules separately for every agent. Building those controls once is the right call. Rebuilding them for every new agent could leave a company with dozens of agents, each following different rules. Salesforce paired the harness with an AI Control Plane, designed as a single place to register agents, set identity and policy, evaluate performance, and control costs. Salesforce says the control plane also covers third-party AI.
The harness builds on work MuleSoft started a year ago. MuleSoft’s Agent Fabric lets companies register agents built anywhere and apply policy to agent traffic that runs through MuleSoft. Since January, it can also scan major cloud agent platforms, list the agents running on them, and record what each can do. Finding the agents comes first. A team can launch an agent on another platform without IT ever knowing. Nobody can set rules for an agent the company doesn’t know exists. Salesforce designed the harness to tie those rules to each company’s records and permissions.
Informatica lets agents check the data before they act on it
In my view, bad data sinks more AI projects than weak models do. Agents raise the stakes by acting on data rather than just reporting on it. Salesforce is building part of its harness on Informatica, the data management company it bought last year. Informatica’s tools track lineage, meaning where data came from and how it changed, and check data quality.
Informatica has offered its data tools to agents on Amazon Web Services since May. Salesforce expanded the AWS integration at Dreamforce. The tools run as MCP servers, allowing agents to call them via an open standard. An agent can check a data-quality score or search the data catalog. It can also pull the master record, meaning the official version of a customer or product. A service agent could verify a customer’s address before it ships a replacement order. Several Informatica tools are also available in Microsoft Foundry, where companies build agents, so agents that Salesforce doesn’t host can call Informatica too. Informatica can give Salesforce a seat in agent projects that never touch Salesforce’s CRM. For me, that seat is a big part of what the Informatica acquisition bought Salesforce.
AIforce applies Salesforce’s permissions inside Claude and Slack
AIforce brings Salesforce’s data and workflows into tools like Claude and Slack. For a company that built its business on its own screen, AIforce is a big change. A seller can now work in Claude, and the permissions and records still live in Salesforce. I think the rules are the valuable part, and Salesforce keeps them. Salesforce designed AIforce to run every request on the permissions and business rules a company already has. So an agent working for you only sees what you can see, and any change it makes goes back through Salesforce. The company running the AI model doesn’t retain the business data, according to Salesforce.
Borrowing a person’s permissions carries one risk, though. I’d bet most CRM users can see far more records than they ever open. Salesforce describes AIforce agents reading across hundreds of records at once. So access that sat unused could suddenly get used. Jason argued in August that Salesforce now treats agents as their own kind of user, and I’d say the harness supports his read. The harness is designed to limit each agent to the data and actions it is authorized to use. I’m hoping agent-level limits become the default in AIforce, so an agent reaches only what its task needs.
Hunter’s plan approvals look like the right balance for agent autonomy
Salesforce also built a new engine for agents that pursue goals over days or weeks. Hunter, Salesforce’s outbound sales agent, runs on the engine first. Hunter turns a seller’s request into a plan, drafting the tasks, the schedule, and its own rules for when to check in. The seller approves the plan, and Hunter is designed to ask again before straying from it. An agent can then run on its own for days, with a person signing off on each departure it flags.
Salesforce built Hunter to work inside a company’s business rules and permissions. In Salesforce’s example, though, Hunter decides for itself when it has left the plan. I’d want company-wide approval rules set through the control plane, with each seller tuning inside them. Watching agent behavior is already part of the control plane’s design. The control plane could flag any agent that drifts from the approved plan.
The same goes for handoffs between agents. Agentforce Coworker, the assistant built into Salesforce, already passes work to other Agentforce agents that a company has set up. Salesforce says Coworker stays entirely inside a company’s existing permissions. I want to know whether those permissions still apply after the second or third handoff.
Salesforce’s rules look strongest for agents that face customers
Vendors that run data platforms, IT workflows, and clouds now also sell control planes for agents. Each one starts from the ground it already holds. Salesforce starts from the customer record, the business rules around it, and the data governance underneath. Customer-facing agents make the mistakes customers see, like a wrong refund or a promise the company may have to honor. For those agents, rules anchored in the record are hard to beat. Neutrality matters too when one vendor offers to govern everyone’s agents. MuleSoft and Informatica were both built to work with other vendors’ systems, and I’d want Salesforce to keep them open to other vendors.
Salesforce’s design puts a check at three points where an agent crosses into its stack:
- Salesforce enforces permissions at the record level.
- MuleSoft enforces policies on agent traffic.
- Informatica provides data checks.
I expect companies to center their agent strategy on whoever governs the data their agents act on. Salesforce made a serious bid for that job at Dreamforce.
