Minimal Action Surface: an Agentforce Architecture Guide

What is Minimal Action Surface in Agentforce architecture?

In Agentforce architecture, filter unavailable actions and restrict write permissions so the agent can only do what its use case requires. This guide explains the design decisions, controls, and implementation checks needed to apply the pattern in production.

Every action and every writable field an agent can reach is part of its attack and error surface. A misconfigured agent with broad permissions can create, update, or delete records far beyond what its use case needs, and a single bad instruction can turn that reach into real damage.

Agentforce gives you two complementary levers. Action filters stop the agent from even attempting an action when conditions are not met. Write permissions limit what the agent user can physically change in the org. Together they narrow the blast radius of both mistakes and prompt-based attacks.

Grant capability, not convenience

• Start from zero: attach only the actions the defined topics and instructions actually require.
• Use action filters to make actions unavailable when variables, context, or business rules say they should not run.
• Give the agent user write access only to the objects and fields the use case changes; read access everywhere else.
• Treat filter logic and permission sets as code: version them, review them, and test them like any other control.

Verify the surface end to end

1. Inventory every action assigned to the agent and remove any that no topic or instruction references.
2. Add action filter conditions so actions are hidden unless the required variables and business criteria are satisfied.
3. Audit the agent user's permission sets and object-level and field-level security, stripping write access that the use case does not need.
4. Test with adversarial prompts that try to invoke filtered actions or modify restricted fields, and confirm the agent refuses or the platform blocks the write.