Deploy Real-Time Security Guardrails
Learning Objectives
After completing this unit, you’ll be able to:
- Describe how the Transaction Security Policy Accelerator simplifies policy deployment.
- Create a custom Transaction Security policy using the Condition Builder.
What Is Transaction Security?
Event Monitoring comes with Transaction Security, a tool for creating customizable policy types that proactively enforce your business and security policies. Standard Transaction Security includes a Condition Builder for point-and-click policy creation. Customers with more complex requirements can also create custom policies with Apex. This unit discusses the Transaction Security Policy Accelerator, a free managed package from Salesforce Labs (available on the AgentExchange) that provides prebuilt, best-practice policies you can deploy with a single click, no coding required.
To learn how to craft Transaction Security policies in depth, see the Enhanced Transaction Security Trailhead badge.
One-Click Protection with the Policy Accelerator
As an admin, you know the rules your business needs, like, “Don’t let people export more than 2,000 rows,” or “Challenge users with Multi-Factor Authentication when they access sensitive data from outside the office.” Building these guardrails used to require writing Apex code.
The Transaction Security Policy Accelerator bridges the gap between security guidance and technical execution, with ready-made policies for:
-
Data Protection: Blocking mass data exports
-
Access Control: Requiring Multi-Factor Authentication (MFA) for high-risk logins
-
API Monitoring: Tracking surges in integration activity
For more information on how to install managed packages from AgentExchange, like the Transaction Security Policy Accelerator, take the AgentExchange Basics Trailhead badge.
Custom Defense with the Condition Builder
When a prebuilt template doesn’t fit your needs, the Condition Builder is your next tool. This point-and-click interface, similar to Flow, evaluates events in real time and applies actions like Block, MFA, or Notification based on logic you define.
Logic Category |
Condition Builder Operator |
Admin Use Case Example |
|---|---|---|
Volume Thresholds |
Greater Than |
Block reports that export more than 2,000 rows. |
Entity Specifics |
Contains |
Monitor queries directed at the Lead or Contract objects. |
Client Environment |
Equals/Starts With |
Restrict access from specific browsers or IP ranges. |
Session Security |
Equals |
Trigger MFA if the session security level is LOW or STANDARD. |
Design a Policy: Contract Data Protection
Fatima receives a requirement from Ava, the senior director of Finance, that no one should be able to query Contract records via the API from outside the corporate network. Contracts contain sensitive pricing data that should never leave the building.
Fatima gets to work and designs a policy to protect Alpine Group’s sensitive contract data. She makes sure to avoid common pitfalls in her design.
Mistake |
Why It’s a Problem |
Better Approach |
|---|---|---|
Blocking all report exports. |
Legitimate users can’t do their jobs, flooding you with exception requests. |
Set a row threshold (like >2,000 rows) or target specific report IDs. |
Using Notify when the requirement says to prevent. |
Notification doesn’t stop the action, so the data still leaves. |
Use Block for prevention and Notify for awareness. |
Forgetting to exclude service accounts. |
Integration users get blocked by IP-based policies even when they’re authorized. |
Add a condition to exclude specific User IDs or use logic like |
Setting conditions too broadly on Login Event. |
Blocks all logins from unexpected IPs, locking out remote employees. |
Use MFA instead of Block for login-based policies; trust the user but verify identity |
Fatima creates a policy from the Transaction Security Policies dashboard. She uses the Condition Builder to filter for API Events where users query Contract records from an IP address outside of her company’s building. Then she ensures that any time this event happens, users are blocked from completing the query.
Fatima now has real-time guardrails protecting her org’s most sensitive data without typing any code. Next, learn how to go further by automating full incident responses with Salesforce Flow.