Salesforce announced AIforce at Dreamforce on 15 September 2026, and most of the commentary has been about the interface. Agents read and act on CRM data from Claude, from Slack, from whatever tool someone already has open, instead of making that person log into Salesforce.
That framing is correct and it buries the part that will actually cost implementation teams their weekends.
The UI was doing security work you never wrote down
For fifteen years the Salesforce page layout has been an informal access control layer. A field exists on the object, it is technically readable by the profile, and it simply is not on the layout anyone uses. Nobody sees it, so nobody worries about it.
Field-level security was the formal control. The layout was the practical one. Those two drifted apart quietly in every org I have looked at.
Take the layout away and only the formal control is left. An agent querying on a user's behalf does not read the layout. It reads what the sharing model and FLS permit, which in a ten-year-old org is a noticeably larger set than what the page shows.
Three places this bites first:
- Compensation and cost fields parked on the Opportunity or a custom object, never laid out, never FLS-restricted
- Free-text notes fields holding things people would not put in a structured field, including customer health commentary and occasionally personal data
- Legacy fields from a migration that nobody removed because removing fields is scary
None of that is a Salesforce defect. It is fifteen years of pragmatism meeting a new read path.
Sharing rules were tuned for humans who ask one question
A rep opens an account, reads it, moves on. An agent answering "which of my accounts are at risk" will traverse far more records in one turn than that rep would touch in a day, and it will do so with that rep's permissions.
The permissions are not wrong. The aggregate is new. A rep with access to 400 accounts one at a time has a different practical exposure from the same rep receiving a synthesised summary across all 400 in four seconds. Role hierarchy and criteria-based sharing were written assuming the slow path.
Worth checking before anyone enables an agent for a sales team: what does the most junior person's permission set actually reach when it is read in bulk rather than one record at a time.
Audit stops answering the question you care about
Salesforce logs the query. It logs the API call and the running user. What it does not carry is the reason, because the reason lived in a conversation somewhere else.
Field Audit Trail tells you a record was read. It does not tell you that it was read because someone in a Slack channel asked about a competitor. When a customer eventually asks who looked at their data and why, the answer now spans two systems and only one of them is yours.
Decide where the prompt and response are retained before the first agent goes live, not after the first awkward question.
A sensible order of work
- Run an FLS report against the fields your layouts do not show. Every field readable by a profile and absent from every layout is now effectively exposed.
- Pick the narrowest possible first use case, one object, read only, one team. Resist the platform-wide pilot.
- Set retention for prompts and responses in whichever tool the agent runs in.
- Only then look at write operations, and gate them behind an approval step for anything touching money or contractual terms.
None of that is exciting and all of it is cheaper before launch than after.
The edition change matters here too
The same week brought Salesforce Core, Advanced and Max editions, which replaced Enterprise and Unlimited and bundled Agentforce into every tier with a Flex Credit allocation. Bundled is not the same as configured. The capability arriving in your contract does not mean your org is ready to expose it, and the credits will be consumed by whatever you switch on, including the pilot you did not scope.
If you are deciding between the two agent models before any of this, the practical split between Claudeforce and Agentforce is about where the reasoning happens, not which one is newer. And if you want examples that have published numbers rather than promises, the Agentforce use cases that hold up are the high-volume, documented-answer ones.
For the full announcement breakdown, including the Headless Toolkit and AgentExchange, see what AIforce actually is.
The interface change is the headline. The permission model is the project.
Top comments (0)