Prompts Are Not Controls: an Agentforce Architecture Guide

What is Prompts Are Not Controls in Agentforce architecture?

In Agentforce architecture, move every rule that must hold deterministically out of the prompt and into enforced platform mechanisms. This guide explains the design decisions, controls, and implementation checks needed to apply the pattern in production.

A prompt is a suggestion the model usually follows, not a boundary it cannot cross. Instructions can be overridden by conflicting context, injected content, long conversations that dilute earlier guidance, or plain model variance. A rule that holds in ninety-nine conversations and fails in the hundredth is not a control.

Any rule that must always hold - data access limits, action restrictions, output constraints, escalation requirements - needs enforcement outside the model. Agentforce provides these as guardrails, permissions, topic scoping, and deterministic Apex or Flow logic that executes regardless of what the model decides.

Enforce rules where the model cannot bypass them

• Treat every prompt instruction as advisory; the model follows it probabilistically, not deterministically, so phrasing and repetition do not make it mandatory.
• Place hard boundaries in platform mechanisms: sharing rules, field-level security, action input validation, and guardrails that filter before and after the model runs.
• Assume adversarial input; both users and retrieved external content can carry text that attempts to rewrite the agent's instructions.
• Test controls by trying to break them under hostile conditions, not by confirming the prompt text exists in the configuration.

Move rules out of the prompt

1. Inventory every rule currently expressed only in instructions and classify each as advisory behavior guidance or a mandatory boundary.
2. Re-implement mandatory rules with Agentforce guardrails, topic and action scoping, Apex validation, or Flow logic that runs outside the model's reasoning.
3. Restrict what data and actions the agent can reach through user and integration permissions, not through instructions telling it to abstain.
4. Red-team the agent with prompt injection, contradictory instructions, and edge cases to verify the enforced controls hold when the model is pushed.