Evidence first, confidence second.
Run the review every Monday during delivery and before every release. Each checked item needs current evidence and a named owner. If a critical control fails, fix it before the agent's audience or authority expands.
Bring evidence.Configuration, test results, traces, approvals, and operational thresholds.
Name the owner.Every boundary, control, exception, and alert needs a responsible person.
Treat failure as a gate.A critical miss stops release or expansion until it is resolved and retested.
Trust
What the agent may access
A signed mandate
The agent mandate, business owner, execution context, and human handoff are approved and versioned.
The mandate is a delegation-of-authority document for a non-human worker. Whoever owns the risk signs it - not the builder.
One external Agent User
External-facing agents run as one dedicated Agent User whose permission set is the entire trust boundary, audited on every change.
For an external agent, the Agent User's permission set is the whole boundary. One wrong grant turns least privilege into over-privilege.
The union, reviewed together
Permissions, accumulated reach, record access, and grounded knowledge sources were reviewed together.
Reach accumulates: many legitimate grants can form one bad union. Review permissions, FLS, sharing, and knowledge reach as one picture, not one at a time.
The unauthenticated trap
Unauthenticated sessions resolve record visibility against org-wide defaults, so filters and variables are set at the subagent and action level regardless of OWD.
Anonymous sessions fall back to internal org-wide defaults, which are often broader than intended. Scope the data at subagent and action level instead of trusting OWD.
Zero retention, verified
Zero data retention is verified for every LLM endpoint beyond the boundary, with contractual or configuration evidence on file.
Prompts and completions leaving the org must not be retained or used for training. Keep proof for every endpoint, including traffic through external gateways.
Grounding data hygiene
Grounding sources have named owners, review cycles, and retention rules; stale or confidential content is removed from the index.
Whatever the retriever can reach, the model can repeat. Every source needs an owner, a review cycle, and a working way to evict content from the index.
Adversarial scenarios on record
High-risk, adversarial, privacy, bias, and misuse scenarios have recorded outcomes and owners.
Injection, bias, misuse, and privacy probes need recorded outcomes before launch and after every change. Hallucination is minimized, not eliminated - governance covers the gap.
Learning path
- Einstein Trust LayerSalesforce Docs
- Trust Layer and Zero Data Retention - Agentforce Developer GuideSalesforce Docs
- Best Practices for Agent User PermissionsSalesforce Docs
- Create and Set Up an Agentforce Data LibrarySalesforce Docs
Control
What the agent is allowed to do
Soft vs hard, mapped
Every business rule is classified as soft (instruction-level) or hard-enforced, with the enforcement point named.
Soft rules live in instructions and can be talked around; hard rules are enforced by the platform. Each hard rule should name exactly where it is enforced.
Gates on the irreversible
Irreversible decisions are enforced in Flow, Apex, validation rules, or a deliberate human gate.
Money, contracts, and deletions cannot be undone with an apology. Gate the irreversible in deterministic automation or route it through a human.
Prompts are not controls
No rule that must hold deterministically lives only in a prompt; prompts are never treated as security controls.
A prompt is a suggestion the model usually follows, not a boundary it cannot cross. If a rule must always hold, move it out of the prompt.
Minimal action surface
Action filters remove unavailable actions, while write permissions expose only required objects and fields.
Filters stop the agent from even attempting an action; write permissions limit what it can physically change. Both narrow the blast radius.
Escalation triggers, drilled
Low-confidence, unusual-value, and negative-sentiment cases escalate to a human, and the escalation path was drilled on a real case.
Escalate the unusual: low confidence, odd values, negative sentiment. Define the triggers up front and drill the handoff so a human actually catches it.
Re-verified after change
After every release or org change, action filters and write permissions are re-verified against the mandate.
Releases and org changes silently shift what an agent can do. Re-verify controls after every change, not only before launch.
Bad-day tests, end to end
Errors, escalation, rollback, active versions, credentials, and target-org dependencies were tested end to end.
Test the bad day, not the happy path: failing actions, rollback, credential scope, version drift, and dependencies on other orgs.
Learning path
Observability
What the agent did
Regression scores, separated
Regression tests score routing, action execution, and response quality as separate outcomes.
A correct final answer can hide a failed step. Score topic routing, action execution, and response quality as separate outcomes with their own pass bars.
Per-step scoring
Subagent, action, and response steps are scored individually, so a hidden step failure surfaces even when the final answer looks fine.
Watch the steps, not just the answer. Per-step scoring surfaces a hidden subagent or action failure that the polished final response conceals.
Tracing with an owner
Session tracing is enabled, retained appropriately, and an owner can investigate a real production run.
Metrics raise the alarm; the trace is the evidence. Make sure a named person can actually open and read a real production session.
An owned audit trail
Every agent step is timestamped and reconstructable; the audit trail has a named owner and a governance process.
A reconstructable trail is what stops “the agent decided” from being a defense. The trail needs an owner and governance, not just storage.
Staged rollout
Rollout runs in stages - pilot group, one channel, then wider - with the first baseline taken from the pilot.
Define “good” before you build, then pilot group → one channel → widen. Your first real baseline comes from the pilot, not from a guess.
Baselines with owners
Quality, trust, health, abandonment, and escalation baselines have thresholds and named review owners.
There is no universal pass mark - set the bar against how well a good person does the job. Each metric needs a threshold and a named reviewer.
Monitoring feeds the loop
Production trace and metric reviews end in documented configuration or instruction changes in the next iteration.
Monitoring is the start of the next iteration. A rising share of abandons or escalations is a number, not an anecdote - it should change the configuration.
Learning path
- Refine Your Agents Using a Five-Step Testing StrategyTrailhead
- Learn About Agentforce Testing CenterSalesforce Docs
- Learn About Agentforce Observability - Session Tracing and AnalyticsSalesforce Docs
- Agentforce Deployment Quick LookTrailhead
This checklist moves with Agentforce.
We keep this checklist updated as Agentforce changes. Leave your email and we'll notify you when something new lands.
Production-ready means the complete system can prove its boundaries, enforce its business rules, and explain its operational behavior.