Salesforce's Trust Map

1

Improve output reliability

Guardrails that reduce Hallucinations & Inaccuracy risks by grounding AI responses in trusted context, verifying factual accuracy, and making outputs easier to review.

Supervisory LLMs

Check responses for factual grounding before they are shown to the user.

How It Works

After Agentforce generates a response, another model checks whether it’s supported by available information. If not grounded, Salesforce can revise, regenerate, or suppress it before the user sees it, reducing inaccurate responses.

: Built-in
: Prevent
: Reasoning Engine

Inline Citations

Link AI-generated answers to the relevant grounding sources used to create them.

How It Works

When Agentforce generates a grounded response, it can include citations to the records or documents used to create it, helping users see where information came from and verify AI-generated answers against the source.

: Built-in
: Prevent
: Action Configuration

Agentforce Testing Center / Agentforce Grid

Tests agent responses and helps teams prototype workflows against verified datasets before deployment.

How It Works

Agentforce Testing Center lets teams test agent behavior before deployment using defined prompts and expected outcomes. Agentforce Grid makes AI workflows transparent and testable, helping teams validate outputs, identify issues, and refine behavior before deployment.

: Built-in
: Prevent
: Agentforce Testing Center and Agentforce Grid

Retrieval-Augmented Generation (RAG)

Uses trusted data sources to ground generative AI responses.

How It Works

Before responding, Agentforce retrieves relevant information from trusted enterprise sources, including CRM data, Data 360, and connected knowledge, grounding responses in current business data rather than only pre-trained knowledge.

: Built-in
: Prevent
: Data 360

Feedback Driven Enhancements

Surfaces insights from agent conversations to help administrators identify instruction issues and improve agent guidance over time.

How It Works

Agent observability and analytics tools help admins spot recurring issues, unsupported requests, and instruction conflicts. Reviewing conversation data and performance trends lets teams refine instructions, adjust configurations, and strengthen behavior over time.

: Customizable
: Detect
: Agentforce Observability

Knowledge Improvements

Helps administrators analyze knowledge source usage and identify improvements to strengthen response quality.

How It Works

Agent observability helps administrators see how knowledge sources are used across interactions. Reviewing what supports successful responses and spotting gaps lets teams improve knowledge sources and strengthen response quality over time.

: Customizable
: Detect
: Agentforce Observability

Supervisory LLMs

: Prevent
: Reasoning Engine
: Built-in

Check responses for factual grounding before they are shown to the user.

How It Works

After Agentforce generates a response, another model checks whether it’s supported by available information. If not grounded, Salesforce can revise, regenerate, or suppress it before the user sees it, reducing inaccurate responses.

Inline Citations

: Prevent
: Action Configuration
: Built-in

Link AI-generated answers to the relevant grounding sources used to create them.

How It Works

When Agentforce generates a grounded response, it can include citations to the records or documents used to create it, helping users see where information came from and verify AI-generated answers against the source.

Agentforce Testing Center / Agentforce Grid

: Prevent
: Agentforce Testing Center and Agentforce Grid
: Built-in

Tests agent responses and helps teams prototype workflows against verified datasets before deployment.

How It Works

Agentforce Testing Center lets teams test agent behavior before deployment using defined prompts and expected outcomes. Agentforce Grid makes AI workflows transparent and testable, helping teams validate outputs, identify issues, and refine behavior before deployment.

Retrieval-Augmented Generation (RAG)

: Prevent
: Data 360
: Built-in

Uses trusted data sources to ground generative AI responses.

How It Works

Before responding, Agentforce retrieves relevant information from trusted enterprise sources, including CRM data, Data 360, and connected knowledge, grounding responses in current business data rather than only pre-trained knowledge.

Feedback Driven Enhancements

: Detect
: Agentforce Observability
: Customizable

Surfaces insights from agent conversations to help administrators identify instruction issues and improve agent guidance over time.

How It Works

Agent observability and analytics tools help admins spot recurring issues, unsupported requests, and instruction conflicts. Reviewing conversation data and performance trends lets teams refine instructions, adjust configurations, and strengthen behavior over time.

Knowledge Improvements

: Detect
: Agentforce Observability
: Customizable

Helps administrators analyze knowledge source usage and identify improvements to strengthen response quality.

How It Works

Agent observability helps administrators see how knowledge sources are used across interactions. Reviewing what supports successful responses and spotting gaps lets teams improve knowledge sources and strengthen response quality over time.

2

Protect data access and use

Guardrails that reduce Data Privacy & Personal Data Exposure risks by managing how customer data is retained, retrieved, accessed, and used by AI systems.

Zero Data Retention

Prevents third-party LLM providers from retaining, reviewing, or training on customer data.

How It Works

Salesforce enforces zero data retention with supported model providers, so prompts and responses aren’t retained, reviewed, or used to train models that could benefit the provider or other customers. This keeps organizations in control of their data.

: Built-in
: Prevent
: Salesforce

Secure Data Retrieval

Restricts agents to retrieving only the authorized data needed for a specific task.

How It Works

Agents inherit the current user’s permissions instead of broad CRM access. Agentforce dynamically retrieves only the data authorized and needed for the task, minimizing data exposure in line with data minimization principles by design.

: Built-in
: Prevent
: Access Controls within CRM/Data 360

Action Inputs

Limit the data and context available to an agent to what is needed for a specific action.

How It Works

Inputs define which data fields and context reach Agentforce for a specific action. Rather than exposing full records, administrators map only what’s needed, limiting the customer data included in the prompt and reducing unnecessary exposure.

: Customizable
: Prevent
: Prompt Builder

Authenticated Action Filtering

Ensures agents only perform permitted actions for authenticated users.

How It Works

Before Agentforce performs an action, Salesforce checks whether the authenticated user has the required permissions. If not, the action doesn’t happen. This keeps agent actions aligned with each user’s established access.

: Built-in
: Prevent
: Agentforce Builder

Trusted URLs

Ensures agents only call, generate, or share approved URLs within customer-controlled boundaries.

How It Works

Administrators define approved URLs that Agentforce can access, reference, or share. Before use, Salesforce checks each URL against that list, reducing the risk of agents reaching unapproved destinations or sending data to unauthorized third parties.

: Built-in
: Prevent
: Trusted URLs Setup

Customer Data Opt-Out

Provides customers with controls over how Salesforce can use data for certain predictive models, service improvements, and research activities.

How It Works

Agents interact only with data authorized for the relevant use. Predictive AI model training occurs only for customers who purchase services that involve it, and they can opt out of Salesforce’s use of their data for that training at the org level.

: Built-in
: Prevent
: Data Opt-Out Setup

Zero Data Retention

: Prevent
: Salesforce
: Built-in

Prevents third-party LLM providers from retaining, reviewing, or training on customer data.

How It Works

Salesforce enforces zero data retention with supported model providers, so prompts and responses aren’t retained, reviewed, or used to train models that could benefit the provider or other customers. This keeps organizations in control of their data.

Secure Data Retrieval

: Prevent
: Access Controls within CRM/Data 360
: Built-in

Restricts agents to retrieving only the authorized data needed for a specific task.

How It Works

Agents inherit the current user’s permissions instead of broad CRM access. Agentforce dynamically retrieves only the data authorized and needed for the task, minimizing data exposure in line with data minimization principles by design.

Action Inputs

: Prevent
: Prompt Builder
: Customizable

Limit the data and context available to an agent to what is needed for a specific action.

How It Works

Inputs define which data fields and context reach Agentforce for a specific action. Rather than exposing full records, administrators map only what’s needed, limiting the customer data included in the prompt and reducing unnecessary exposure.

Authenticated Action Filtering

: Prevent
: Agentforce Builder
: Built-in

Ensures agents only perform permitted actions for authenticated users.

How It Works

Before Agentforce performs an action, Salesforce checks whether the authenticated user has the required permissions. If not, the action doesn’t happen. This keeps agent actions aligned with each user’s established access.

Trusted URLs

: Prevent
: Trusted URLs Setup
: Built-in

Ensures agents only call, generate, or share approved URLs within customer-controlled boundaries.

How It Works

Administrators define approved URLs that Agentforce can access, reference, or share. Before use, Salesforce checks each URL against that list, reducing the risk of agents reaching unapproved destinations or sending data to unauthorized third parties.

Customer Data Opt-Out

: Prevent
: Data Opt-Out Setup
: Built-in

Provides customers with controls over how Salesforce can use data for certain predictive models, service improvements, and research activities.

How It Works

Agents interact only with data authorized for the relevant use. Predictive AI model training occurs only for customers who purchase services that involve it, and they can opt out of Salesforce’s use of their data for that training at the org level.

3

Reduce unsafe AI behavior

Guardrails that reduce Toxic or Offensive Content risks by detecting harmful inputs, guiding responses away from unsafe content, and flagging potentially toxic outputs for review or enforcement.

Input Toxicity Detection

Scans user inputs for hate speech, harassment, or harmful language and then records a score in the audit trail.

How It Works

Salesforce evaluates user inputs for harmful content, like hate speech, harassment, or threats, before Agentforce processes them, recording a score for review. When content crosses the threshold, Salesforce can block it before it reaches the agent.

: Built-in
: Prevent
: Trust Layer

Output Toxicity Scoring & Flagging

Scores potentially toxic outputs, records the score in the audit trail, and flags them to the user for review or policy enforcement.

How It Works

Salesforce evaluates Agentforce responses for harmful or offensive content before or as they’re delivered. Toxicity scores are logged in the audit trail and can be surfaced for review or policy enforcement, helping teams monitor patterns over time.

: Built-in
: Detect
: Salesforce

Inappropriate Content Filtering

Intercepts inappropriate, harmful, or policy-violating inputs before routing and returns a safe, default response.

How It Works

Before routing, built-in safety rules check inputs. Blocked requests receive a safe default response instead of proceeding through reasoning. Unlike standard instruction templates, this hardened control cannot be modified.

: Built-in
: Prevent
: Agentforce Builder

Input Toxicity Detection

: Prevent
: Trust Layer
: Built-in

Scans user inputs for hate speech, harassment, or harmful language and then records a score in the audit trail.

How It Works

Salesforce evaluates user inputs for harmful content, like hate speech, harassment, or threats, before Agentforce processes them, recording a score for review. When content crosses the threshold, Salesforce can block it before it reaches the agent.

Output Toxicity Scoring & Flagging

: Detect
: Salesforce
: Built-in

Scores potentially toxic outputs, records the score in the audit trail, and flags them to the user for review or policy enforcement.

How It Works

Salesforce evaluates Agentforce responses for harmful or offensive content before or as they’re delivered. Toxicity scores are logged in the audit trail and can be surfaced for review or policy enforcement, helping teams monitor patterns over time.

Inappropriate Content Filtering

: Prevent
: Agentforce Builder
: Built-in

Intercepts inappropriate, harmful, or policy-violating inputs before routing and returns a safe, default response.

How It Works

Before routing, built-in safety rules check inputs. Blocked requests receive a safe default response instead of proceeding through reasoning. Unlike standard instruction templates, this hardened control cannot be modified.

4

Keep AI agents within their intended role

Guardrails that reduce AI System Integrity risks by detecting prompt manipulation, enforcing system policies, and keeping agents aligned to their intended business purpose.

Prompt Injection Detection Model (PID)

Identifies malicious prompt patterns before the agent takes any action.

How It Works

The Prompt Injection Detection Model scans every user prompt for patterns linked to injection attacks, like attempts to override instructions or extract system prompts. Suspicious prompts are scored and logged before the agent can act.

: Built-in
: Detect
: Trust Layer

PID Topic Classification

Identifies malicious prompt patterns within the AI reasoning engine.

How It Works

PID Topic Classification evaluates prompts throughout the agent’s reasoning process to identify out-of-scope or adversarial requests. Unsafe requests are blocked, providing added protection against attacks that evade initial detection.

: Built-in
: Prevent
: Salesforce

Global Instructions

Provide core instructions that guide agent behavior across all interactions.

How It Works

Global Instructions define the agent’s core role, behavioral expectations, and standing rules for every interaction, guiding how it interprets prompts, selects actions, and responds to users throughout the conversation.

: Customizable
: Prevent
: Agentforce Builder

Subagent Instructions

Provide context-specific guidance for how the agent uses actions and responds.

How It Works

Subagent Instructions give task-specific guidance for individual subagents, defining how they reason, respond, and use available actions. Each subagent operates only within its assigned instructions, keeping delegated tasks aligned with their purpose.

: Customizable
: Prevent
: Agentforce Builder

Subagent Controls

Help keep agents within their assigned business purpose through defined controls, rules, deterministic logic, and access restrictions.

How It Works

Subagent Controls define the rules, access restrictions, and deterministic logic that govern what a subagent can do. Checked each time it acts, they help ensure it only accesses approved data and stays within its purpose.

: Customizable
: Prevent
: Agent Script

Action Descriptions

Define the agent’s specific capabilities and when those actions should be taken.

How It Works

Action Descriptions explain what each available action does and when to use it. The agent uses these during reasoning to pick the best match for a request. Clear descriptions reduce the risk of unintended tool use.

: Customizable
: Prevent
: Agentforce Builder

Prompt Injection Detection Model (PID)

: Detect
: Trust Layer
: Built-in

Identifies malicious prompt patterns before the agent takes any action.

How It Works

The Prompt Injection Detection Model scans every user prompt for patterns linked to injection attacks, like attempts to override instructions or extract system prompts. Suspicious prompts are scored and logged before the agent can act.

PID Topic Classification

: Prevent
: Salesforce
: Built-in

Identifies malicious prompt patterns within the AI reasoning engine.

How It Works

PID Topic Classification evaluates prompts throughout the agent’s reasoning process to identify out-of-scope or adversarial requests. Unsafe requests are blocked, providing added protection against attacks that evade initial detection.

Global Instructions

: Prevent
: Agentforce Builder
: Customizable

Provide core instructions that guide agent behavior across all interactions.

How It Works

Global Instructions define the agent’s core role, behavioral expectations, and standing rules for every interaction, guiding how it interprets prompts, selects actions, and responds to users throughout the conversation.

Subagent Instructions

: Prevent
: Agentforce Builder
: Customizable

Provide context-specific guidance for how the agent uses actions and responds.

How It Works

Subagent Instructions give task-specific guidance for individual subagents, defining how they reason, respond, and use available actions. Each subagent operates only within its assigned instructions, keeping delegated tasks aligned with their purpose.

Subagent Controls

: Prevent
: Agent Script
: Customizable

Help keep agents within their assigned business purpose through defined controls, rules, deterministic logic, and access restrictions.

How It Works

Subagent Controls define the rules, access restrictions, and deterministic logic that govern what a subagent can do. Checked each time it acts, they help ensure it only accesses approved data and stays within its purpose.

Action Descriptions

: Prevent
: Agentforce Builder
: Customizable

Define the agent’s specific capabilities and when those actions should be taken.

How It Works

Action Descriptions explain what each available action does and when to use it. The agent uses these during reasoning to pick the best match for a request. Clear descriptions reduce the risk of unintended tool use.

5

Keep agent actions within defined boundaries

Guardrails that reduce Autonomous Deviations risks by defining when AI should continue, pause, escalate to a person, or stop before taking sensitive actions.

Deterministic Controls

Use predefined business logic and verification steps for sensitive actions.

How It Works

Customers define deterministic logic for actions needing predictable outcomes, like approvals, transactions, or compliance workflows. When conditions are met, Agentforce follows that logic instead of generative reasoning for consistent behavior.

: Customizable
: Prevent
: Agentforce Builder

Human Handoff Criteria

Escalates requests to a human when they fall outside the agent’s assigned responsibilities or confidence thresholds.

How It Works

Customers define when Agentforce should hand a conversation to a person, like requests outside its responsibilities, needing judgment, or meeting confidence thresholds. Context then transfers to a human so work continues without restarting.

: Customizable
: Prevent
: Agentforce Builder

Pause-for-Review Gates

Pause execution to run quality, ethics, or policy checks before taking action.

How It Works

Customers can set review points where Agentforce pauses before completing a sensitive action, letting a person or process review it first. This adds oversight before high-impact actions are taken.

: Customizable
: Prevent
: Agentforce Builder

Override Controls

Allow authorized users to pause, edit, or cancel agent actions when intervention is needed.

How It Works

Authorized users can pause, modify, or cancel pending agent actions when intervention is needed, stepping in before an action completes to maintain human oversight in sensitive or evolving situations.

: Customizable
: Prevent
: Agentforce Builder

Enterprise-Sanctioned Tools

Restrict agents to approved tools to help prevent unauthorized data use or leakage.

How It Works

Customers define the tools, APIs, and integrations available to each agent. Agentforce can invoke only the approved tools assigned to it, keeping actions within systems the organization has authorized.

: Customizable
: Prevent
: Salesforce

Instruction Adherence

Evaluates whether an agent follows defined instructions.

How It Works

Agentforce continuously checks planned responses and actions against its configured instructions. If a conflict arises, it responds within that guidance or flags the request as out of scope, keeping behavior aligned with its purpose.

: Built-in
: Detect
: Reasoning Engine

Deterministic Controls

: Prevent
: Agentforce Builder
: Customizable

Use predefined business logic and verification steps for sensitive actions.

How It Works

Customers define deterministic logic for actions needing predictable outcomes, like approvals, transactions, or compliance workflows. When conditions are met, Agentforce follows that logic instead of generative reasoning for consistent behavior.

Human Handoff Criteria

: Prevent
: Agentforce Builder
: Customizable

Escalates requests to a human when they fall outside the agent’s assigned responsibilities or confidence thresholds.

How It Works

Customers define when Agentforce should hand a conversation to a person, like requests outside its responsibilities, needing judgment, or meeting confidence thresholds. Context then transfers to a human so work continues without restarting.

Pause-for-Review Gates

: Prevent
: Agentforce Builder
: Customizable

Pause execution to run quality, ethics, or policy checks before taking action.

How It Works

Customers can set review points where Agentforce pauses before completing a sensitive action, letting a person or process review it first. This adds oversight before high-impact actions are taken.

Override Controls

: Prevent
: Agentforce Builder
: Customizable

Allow authorized users to pause, edit, or cancel agent actions when intervention is needed.

How It Works

Authorized users can pause, modify, or cancel pending agent actions when intervention is needed, stepping in before an action completes to maintain human oversight in sensitive or evolving situations.

Enterprise-Sanctioned Tools

: Prevent
: Salesforce
: Customizable

Restrict agents to approved tools to help prevent unauthorized data use or leakage.

How It Works

Customers define the tools, APIs, and integrations available to each agent. Agentforce can invoke only the approved tools assigned to it, keeping actions within systems the organization has authorized.

Instruction Adherence

: Detect
: Reasoning Engine
: Built-in

Evaluates whether an agent follows defined instructions.

How It Works

Agentforce continuously checks planned responses and actions against its configured instructions. If a conflict arises, it responds within that guidance or flags the request as out of scope, keeping behavior aligned with its purpose.