Skip to main content
Group

Architect Trailblazers

Building an eco-system of domain and technical architect experts. Join this group if you want to go down the path of becoming any type of Architect! Updates on the Architect Journey as well as other important information regarding Architect credentials.

I am trying  to show team Hierarchy   like User and Manager   - by using User and Manager lookup join  in recipe I am able to get only immediate(direct)  reporting and opportunity amount rollup.   I need to show rollup based on hierarchy top to bottom such as   EmpM1 ->EmpM2 -> SalesRep1 and SalesRep2,SalesRep3  and SalesRep1 > SalesSubRep1 , SalesSubRep2, SalesSubRep3,SalesSubRep4

 

This is my Expectation 

EmpM1 - 8

EmpM2 - 7

SalesRep1  - 4 

 

I am getting from my recipe 

EmpM1 - 1

EmpM2 - 3

SalesRep1  - 4

 

Can any one hep how to achieve this requirement ?

1 answer
  1. Aug 24, 11:39 PM

    @Ritesh Gupta

    Did you try flatten transformation (not a lookup join)?  

    If not, try this 

    Add a Flatten node in your recipe (or dataflow) on the hierarchy, using the User Id as the self ID and Manager Id as the parent. Flatten outputs a multi-value roll-up hierarchy field containing every ancestor for each user. 

    Then join your opportunity data to users. When you group by that flattened ancestor field instead of the direct manager field, each opportunity counts toward every manager in that user's chain.  

    Basically, don't roll up by 'who's your manager' instead, roll up by 'who's anywhere above you' Flatten gives you that second thing as a queryable field, and grouping on it produces the top-to-bottom totals you're expecting.  

    Hope this works. thanks! 

0/9000

 

Agentforce isn't magic. It's architecture and if you skip the architecture part, your agents will happily make very confident, very wrong decisions at 2 AM. No errors. No warnings.

Agentforce isn't magic. It's architecture and if you skip the architecture part, your agents will happily make very confident, very wrong decisions at 2 AM. No errors. No warnings. Just chaos with a smile. 

 

In Episode 11, we open a brand-new season of The Franken Org focused entirely on Agentforce and agent architecture. 

 

This episode covers: 

  • 🧠 What the Atlas Reasoning Engine actually does, step by step 
  • 🗂️ Subagents, Actions, and Instructions, the three levers you control 
  • 🛡️ Why grounding and the Trust Layer are non-negotiable 
  • 🔥 The (true-ish) story of the night FrankenForce's support agent approved 47 refunds before breakfast

🎧 Episode 11 is live now. 

 

Youtube :

https://youtu.be/HTfTu1V45u8?si=p-o1XMTtXj8Vwn14

 

Spotify :

https://open.spotify.com/episode/5lu7894nDE2OmnFSav4Nu1

 

 

@Salesforce Developer Group, Dubai, UAE @Agentblazer Community Group @* Salesforce Developers * @WFD Partner Cohort: TDX2630DaysChallenge @Architect Trailblazers

0/9000

Has anyone had an org get terabytes of data for free? Are there products that are sold that come with large amounts of data? Every org that I have been part of has started at 10GB.

4 answers
  1. Aug 15, 5:34 AM

    Yes, in my question I do refer that there is no cost in the contract for extra data. I am wondering if there are products that come with extra data that are part of it. There are no line items for extra data.

0/9000

💻 True to the Core Deep Dive: Salesforce Multi-Framework and Headless Experience Layer Recap

 

Thank you to everyone who joined today's True to the Core Deep Dive, and a special thanks to Salesforce product leaders @David Green, Clay Martin, and @Julie Thompson for sharing the latest updates and answering your thoughtful questions.

 

🎥 Missed the session?

 Watch the full episode on demand here. 💻 True to the Core Deep Dive: Salesforce Multi-Framework and Headless Experience Layer Recap Thank you to everyone who joined today's True to the Core Deep Dive, and a special thanks to Salesforce pr💬 Still have questions?

 Drop them in the comments below, and we'll do our best to get you answers.

 

📝 Help shape future TTTC Deep Dive sessions! 

Take a minute to complete our feedback survey and let us know what topics you'd like to see next: 

https://sforce.co/tttcddfeedback

 

🔗 Resources shared during the session:

  • Read the Salesforce Developers blog to learn how to build React apps with Salesforce Multi-Framework, now generally available: https://sforce.co/4yKe7hx
  • Explore the Headless Experience Layer Playground to experiment with Salesforce Headless 360 capabilities: https://sforce.co/44TRtpj

#True To The Core @IdeaExchange #AwesomeAdmins #Salesforce Developer #Architects

 

@Salesforce Admins Live Sessions, @* Release Readiness Trailblazers *, @* Salesforce Platform *, @* Trailhead Official *, @Trailblazer Community Cove, @Admin Addicts, @* Salesforce Developers *, @Dreamforce for Admins, @Architect Trailblazers

2 comments
0/9000

How can we secure Salesforce hosted MCP server that it has less record access provided to Claude users - based on record fields such as country or product line, similar to attribute based access control - than if they were logging into Salesforce from a browser? 

 

We do not want to change the record sharing and access rules in Salesforce for logged in users but want to restrict it for Claude or other AI tool users.  

 

What options would you recommend? 

 

 

8 answers
  1. Aug 3, 11:04 AM

    The cleanest way to avoid touching Salesforce sharing rules is enforcing access at the MCP layer. Browser users hit Salesforce normally, AI agent traffic goes through a separate policy layer that redacts fields based on country, product line, whatever attributes you need, before the data reaches the agent.  

     

    We do this at DataGrout if it's useful to look at.

0/9000

I've submitted a Idea to bring "Formula Evaluates to True" to Scheduled Flows, helping bring them in line with Record-Triggered Flows.  If this would make your life easier too, I'd really appreciate an upvote! 🙌 

 

https://ideas.salesforce.com/s/idea/a0BHp000017Jl5jMAC/bring-formula-evaluates-to-true-to-scheduled-flow-start-conditions

 

#Salesforce #SalesforceMVP #TrailblazerCommunity #Flow #AwesomeAdmins

 

@* Salesforce Developers * @* Salesforce Platform * @* Customer Success * @Architect Trailblazers @Consultant Trailblazers @Trailblazer Community Cove 

6 comments
0/9000

Yalla Habibi! 🚨 Grab your Karak, because the Dubai Trailblazer Community’s favorite duo is officially BACK! ☕✨ 

 

Yes, you read that right—whoever was missing Maham, she’s back! The M&M of the Trailblazer Community are reuniting to bring you a hands-on workshop on Salesforce Headless 360 on 8th August

! 💻⚡ 

 

BUT... before we hit the lab, you have mandatory prep work. You need to meet my stitched-together co-host, Frankie!

🧟‍♂️🎙️ 

 

1️⃣ Step 1: Listen to Frankie & me on Spotify: 👉 https://open.spotify.com/episode/1kbLoZ4pwb6tNs3dNymXDK

 

2️⃣ Step 2: Lock in your spot for 8th August: 👉

https://trailblazercommunitygroups.com/j/wqxw5khm34zw2/

 

Don't leave your RSVP to the last minute like Sheikh Zayed Road 6 PM traffic! See you all on August 8th! 🚗💨  

 

@Salesforce Developer Group, Dubai, UAE @Agentblazer Community Group @* Salesforce Developers * @WFD Partner Cohort: TDX2630DaysChallenge @Architect Trailblazers 

2 comments
0/9000

We have Azure 365 SSO implemented for Salesforce i.e. we are login with Microsoft Azure 365 credentials in Salesforce via SSO. I want to know how we can get Salesforce token using Azure 365 token to call Salesforce API  

2 answers
  1. Jul 28, 10:17 AM

    Hi @Khyati Mehta - Thank you for your inputs. Our need is get Salesforce token using Azure 365 token. We are already using Client Credentials oAuth flow (for server to server communication) & able to call Salesforce API. However in this case insert API operation will be carried out as per user used in oAuth flow i.e. created by name will user used in oAuth flow. We want to get user specific Salesforce token without using Authorization Code oAuth flow as we don't have UI interface. 

0/9000

📣 Extend Data 360 with Code Extension: New Salesforce Developers YouTube Series 

 

Need custom logic that goes beyond Data 360's native capabilities? Our new YouTube series shows you how to build and debug custom Python code locally, then deploy and monitor it in Data 360 using the Data 360 Code Extension SDK and Claude Code. Follow Salesforce Developer Advocate @Alba Rivas as she walks through the complete development workflow, from local development to production. 

 

🔍 In this series, you’ll learn how to:  

 

🔹 Run custom code securely within Data 360  

🔹 Build custom Python scripts for batch transforms and custom search index chunking using the Data 360 Code Extension SDK and Claude Code 

🔹 Deploy and monitor Data 360 Code Extensions in production 

 

🎥 Watch the full series today: https://sforce.co/4fA1oFo

 

Want more resources for Salesforce Developers?   

 

 📣 Extend Data 360 with Code Extension: New Salesforce Developers YouTube Series Need custom logic that goes beyond Data 360's native capabilities?

1 comment
0/9000

Ran into this during a security review for a client and wanted to share it with the architect community, since it's the kind of thing that quietly fails least-privilege audits.

The ask was simple: a service account needs to run a read-only Tooling API query against InstalledSubscriberPackage, just to report which managed packages/versions are installed. No install, no uninstall, just read.

Turns out the only permission that grants access to that object is "Download AppExchange Packages" — which also grants install and uninstall rights for AppExchange packages org-wide. There's no granular read-only alternative. Confirmed this directly with Salesforce Support (Case 474178877): that permission is currently the only path to query InstalledSubscriberPackage.

For anyone doing security reviews on integration users, this is worth knowing: if you see "Download AppExchange Packages" assigned to a service account, don't assume it's just for reporting — it's also an install/uninstall grant. Best mitigation right now:

- Assign via a dedicated Permission Set scoped to only that service account, never on a profile

- Base the account on Minimum Access - API Only Integrations

- Document it as a known least-privilege exception, since it isn't a true fix

Filed an idea to get a proper read-only permission added:

https://ideas.salesforce.com/s/idea/a0BHp000017JmFfMAK/granular-readonly-permission-to-query-installedsubscriberpackage

If you've hit this same wall on a client integration or audit, an upvote helps get it prioritized. Curious if others have found a cleaner workaround than permission-set scoping.

0/9000