I’m testing an Agentforce agent that needs to query Salesforce records and perform actions on them. I want to make sure the agent only accesses records that the appropriate user is authorized to see.
What is the recommended way to configure permissions, sharing rules, and object/field-level security for an Agentforce agent? Are there any best practices for preventing the agent from accessing records outside the intended user’s permissions?
#Agentforce
Hi Liza - the key model is that an Agentforce agent accesses data as a Salesforce user, so its record access is governed by that user's permissions and sharing - the same controls you'd use for a person. There isn't a separate 'agent record access' system; you configure the running user.
First, know which user the agent runs as:
- Autonomous / Service agents run as a dedicated assigned agent user (not the end customer). Whatever that user can see, the agent can see - so scope that user tightly.
- Employee/assistant agents run in the context of the logged-in user, so they naturally respect that user's access.
Pick the type that matches your requirement, then configure the running user's access to exactly the intended scope.
How to lock it down:
1) Object + field security (FLS): give the agent's user a dedicated permission set (least privilege) granting only the objects and fields it needs - read where it queries, create/edit only where it acts. Anything not granted is invisible to the agent.
2) Record-level (sharing): set OWD to the most restrictive level (Private), then open up only what's intended via sharing rules / role hierarchy. The agent inherits the running user's record visibility, so it can't return records that user can't see.
3) Actions carry context too: the agent touches records through its actions (Flows/Apex). Run those Flows in user context (the default - respects sharing + FLS) rather than System Context, which bypasses them. Use system context only deliberately, and validate inputs when you do.
4) Sensitive fields: use the Einstein Trust Layer's data masking so PII isn't sent to the model even for records the agent can read.
Best practices to prevent over-reach:
- Principle of Least Privilege: a dedicated permission set (or permission set group) for the agent user with the minimum objects/fields/records.
- Restrictive OWD plus targeted sharing rather than broad access.
- Keep actions in user context; reserve system context for narrow, reviewed cases.
- Test by checking the agent user's own access to confirm it genuinely can't reach out-of-scope records - the agent never exceeds what that user can access through normal sharing/FLS.
Refs:
- Give Users Access to Agentforce:
https://help.salesforce.com/s/articleView?id=ai.copilot_setup_user_access.htm&type=5- Get Agentforce Ready - Profiles to Permission Sets:
https://admin.salesforce.com/blog/2025/get-agentforce-ready-move-from-profiles-to-permission-sets-how-i-solved-it
