What is Flows, Actions, and Permissions in Agentforce architecture?
In Agentforce architecture, combine deterministic automation and platform access controls. This guide explains the design decisions, controls, and implementation checks needed to apply the pattern in production.
An agent can reason about when to perform work, but business side effects should run through explicit actions. Flows package deterministic automation; action definitions make that automation understandable to the agent; permissions set the outer boundary.
These layers must agree. A well-described action without the right permissions fails at runtime, while broad permissions behind a vague action create unnecessary risk.
Design a narrow write path
- Create small, single-purpose actions with names and descriptions that clearly state when they should be used.
- Expose only the inputs and outputs needed for the decision and user response.
- Validate business limits inside Flow, Apex, or platform rules instead of trusting generated arguments.
- Grant the agent user the minimum object and field permissions required by the approved action.
Make the action production-ready
- Define success, validation failure, integration failure, and timeout outputs.
- Test the action directly before testing whether the agent selects it correctly.
- Verify permissions and active Flow versions in the target environment after deployment.
- Trace inputs and outputs while preventing secrets or unnecessary personal data from entering logs.
Resources
This Tucario article is based on the following Salesforce learning and product documentation.