I woke up Monday morning to a notification that Salesforce had quietly laid off close to 1,000 people. By Wednesday, five executives were gone. By Thursday, Heroku was effectively dead. And by Friday, Spring '26 dropped with the most aggressive set of enforcements, betas, and identity shifts the platform has seen in a single release.
If you read the headlines, it looked like chaos. If you read the release notes, it looked like a blueprint.
Salesforce isn't falling apart. It's performing a controlled demolition of its pre-AI self. The news shows you the demolition. The release shows you what's going up in its place.
This newsletter is structured in four parts:
- The News — what happened, who left, and what signals are buried in the noise
- The Release — what actually changed in Spring '26, organized by role
- The Survival Guide — two migrations you cannot ignore
- The Career Calculus — what certifications, skills, and roles actually matter now
Let's get into it.
The Release
Spring '26 isn't just a release. It's an identity shift.
The most telling change isn't a feature. It's a name. Sales Cloud is now Agentforce Sales. Not "Sales Cloud with Agentforce." Not "Sales Cloud, powered by AI." The product formerly known as Sales Cloud has been absorbed into the Agentforce brand.
That naming convention tells you everything about Salesforce's internal priorities. The cloud model is being subordinated to the agent model. Products aren't organized by business function anymore. They're organized by how agents interact with them.
Here's what actually shipped, organized by who it affects.
For Admins
Editable Data Table for Flow (GA)
After years of being one of the most requested features on IdeaExchange, editable data tables in Screen Flows are finally generally available. Users can view, inline-edit, and interact with tabular data directly within a flow screen. No more building custom LWC components just to let someone edit a list of records. No more sending users to a list view and hoping they come back.
This single feature eliminates one of the most common reasons admins had to involve developers in screen flow projects.
Error Console for Flow Builder
Flow Builder now includes a dedicated error console that surfaces validation errors, warning messages, and runtime debugging information in a centralized panel. Instead of hunting through execution logs or guessing why a flow failed in production, you can see issues as you build.
File Deletion Permissions
Admins can now grant file deletion permissions at a granular level without giving users broad content management access. This has been a pain point for years in regulated industries where document lifecycle management requires precise control over who can delete what.
Shield Experience Improvements
Platform Encryption, Event Monitoring, and Field Audit Trail received UX updates that consolidate the Shield experience into a more unified interface. If you're in a regulated industry and you've been managing Shield across three different setup pages, this consolidation matters.
Flow Builder Improvements
Beyond the data table, Flow Builder received collapsible branching elements for managing complex decision trees, component-level styling overrides for screen flows, and improved debugging tools. The platform is clearly investing in making Flow the primary automation surface, not just an alternative to Process Builder and Workflow Rules (both of which are long deprecated).
Setup with Agentforce (Beta)
This is the one to watch. Salesforce is beta-testing an AI-powered setup assistant that lets admins configure platform features using natural language prompts directly in Setup. Instead of navigating through Setup menus to find the right page, you describe what you want to configure and the agent guides you there or does it for you.
It's beta. It's limited. But the direction is unmistakable: Setup itself is becoming an agent-mediated experience.
For Developers
TypeScript for Lightning Web Components (Beta)
Developers can now write LWC component logic in TypeScript instead of JavaScript. Type safety, better IDE support, compile-time error checking, and improved refactoring support. This has been requested since LWC launched in 2019.
The beta has limitations — not all LWC features are TypeScript-compatible yet, and there are compilation performance considerations. But for any development team that's been maintaining large LWC codebases in JavaScript, this is the beginning of a real improvement in code quality and maintainability.
Apex Cursors
Apex now supports cursor-based pagination for SOQL queries, allowing developers to process large datasets without hitting governor limits on heap size. Instead of loading entire query results into memory, you can iterate through results in manageable chunks using a cursor.
This is a fundamental improvement for any org processing large data volumes in Apex. Batch Apex has always been the workaround, but cursors provide a more elegant, inline solution for scenarios where you need to process thousands of records within a single transaction context.
RunRelevantTests (Beta)
The deployment pipeline now includes a beta option to run only the tests that are relevant to the components being deployed, rather than running the entire test suite. For orgs with thousands of Apex tests, this could reduce deployment times from hours to minutes.
The beta uses dependency analysis to determine which tests cover the classes and triggers being deployed. It's not perfect yet — there are edge cases around indirect dependencies — but for large enterprise orgs where deployment windows are measured in hours, this is a significant productivity improvement.
Agentforce DX and Agent Script
Salesforce introduced new developer tooling for building, testing, and deploying agents programmatically. Agentforce DX provides CLI commands for agent development workflows, and Agent Script is a new declarative language for defining agent behaviors, guardrails, and escalation paths.
This is the developer equivalent of the admin's "Setup with Agentforce" beta. Salesforce is building a parallel development surface specifically for agent configuration, separate from but complementary to traditional metadata deployment.
Enforcements
This is where Spring '26 gets serious. Four enforcements are hitting that you cannot ignore.
Legacy Hostname Permanent End
Salesforce is permanently retiring legacy hostnames. If your org is still using non-instanced URLs (like na1.salesforce.com instead of yourorg.my.salesforce.com), those URLs will stop resolving. This affects bookmarks, API integrations, middleware configurations, SSO identity provider settings, and any hardcoded references in custom code.
This isn't new. Salesforce has been warning about this for two years. But "warning" is now "enforcing." If you haven't migrated, you will experience outages.
Connected App Creation Disabled
Salesforce is disabling the creation of new Connected Apps using the legacy method. All new OAuth integrations must use External Client Apps, which provide enhanced security controls, support for second-generation managed packages (2GP), and better lifecycle management.
Existing Connected Apps will continue to function, but you cannot create new ones. If your integration roadmap includes new OAuth connections, you need to use External Client Apps from this release forward.
TLS Certificate Changes
Salesforce is updating its TLS certificate chain. If your integrations use certificate pinning (hardcoding specific certificate fingerprints instead of validating the certificate chain), those integrations will break when the certificates rotate.
This is a silent killer. Most orgs don't know if their middleware or custom integrations use certificate pinning until the certificates change and everything stops working. Audit your integration layer now.
Session IDs Removed from Outbound Messages
Outbound messages from workflow rules and flows will no longer include the Session ID of the triggering user. If you have downstream systems that use Session IDs from outbound messages to make authenticated callbacks to Salesforce, those integrations will break.
The fix is to use OAuth-based authentication instead of Session ID passthrough. But this requires changes to your receiving systems, not just your Salesforce configuration.
The Survival Guide
Two migrations demand your attention right now. Not next quarter. Not when you "have time." Now.
1. Migrate Connected Apps to External Client Apps
Why it matters: Connected Apps were designed in an era before OAuth 2.0 best practices, before second-generation packaging, and before AI agents needed to authenticate across systems. External Client Apps provide:
- Enhanced security controls — scoped permissions, token management, and revocation capabilities that Connected Apps lack
- OAuth 2.0 compliance — alignment with current IETF specifications for authorization flows
- 2GP support — if you're building managed packages, External Client Apps work with second-generation packaging; Connected Apps don't
- Agent compatibility — Agentforce agents authenticate using External Client Apps, not Connected Apps
What to do:
- Inventory every Connected App in your org (Setup → App Manager)
- Identify which ones are actively used, by whom, and for what purpose
- For each active Connected App, create an equivalent External Client App with matching OAuth scopes
- Update consuming applications to use the new client credentials
- Test thoroughly in sandbox before touching production
- Decommission legacy Connected Apps after confirming all consumers have migrated
Timeline: New Connected App creation is disabled in Spring '26. Existing apps still work, but the migration path gets harder the longer you wait. Start now.
2. Update Legacy Hostnames
Why it matters: Legacy hostnames are being permanently retired. Any reference to old-style Salesforce URLs will fail.
What to audit:
- Bookmarks and documentation — every saved link, wiki page, and runbook that references a Salesforce URL
- API integrations — every system that calls Salesforce APIs using hardcoded hostnames
- Middleware configurations — MuleSoft, Informatica, Boomi, Jitterbit, and custom middleware that references Salesforce endpoints
- Custom code — Apex callouts, LWC fetch calls, and Visualforce pages with hardcoded URLs
- SSO and identity providers — SAML endpoints, OAuth redirect URIs, and identity provider configurations that reference legacy hostnames
- Email templates and merge fields — any template that constructs URLs using legacy hostname patterns
What to do:
- Run a global search across your codebase, integration configurations, and documentation for any reference to legacy hostname patterns
- Replace all instances with My Domain URLs (
yourorg.my.salesforce.com) - Test every integration in sandbox after updating
- Coordinate with external partners and vendors who may be calling your Salesforce org using legacy URLs
- Update DNS records if you have custom domain configurations that rely on legacy hostname resolution
Timeline: Permanent. There is no extension. Legacy hostnames will stop resolving in Spring '26.
The Career Calculus
The Certification Shakeup
Salesforce retired the AI Associate certification. If you earned it, it still counts on your transcript, but it's no longer available to new candidates and it's no longer a differentiator.
The replacement path is two-pronged:
- Agentblazer Status — a new community-based recognition program that tracks your engagement with Agentforce features, content, and community contributions
- Agentforce Specialist Certification — a hands-on certification that requires you to demonstrate practical ability to configure, deploy, and manage Agentforce agents in a sandbox environment
The shift from AI Associate to Agentforce Specialist tells you exactly where Salesforce sees the skill gap. They don't need people who understand AI concepts. They need people who can build and operate agents. Theory is out. Implementation is in.
The Market Reality
Evaldas Zaranka, Salesforce Engineering Manager at Wise, shared a perspective that every job seeker needs to hear: "The entry-level Salesforce market is more crowded than it's ever been. There are more certified admins and developers than there are entry-level positions. But at the specialist level — Data Architecture, integration design, security governance, agent orchestration — demand is outstripping supply by a significant margin."
The data backs this up. Average salaries for generalist admins have flattened or declined in most regions. Architecture and specialist roles continue to command premiums of 40-80% over generalist equivalents. The market isn't shrinking. It's bifurcating. Generalists are competing for fewer positions at lower pay. Specialists are fielding multiple offers.
The Skills That Matter
If you're planning your professional development for the next 12-18 months, four skill areas are disproportionately valuable:
Data Architecture
Every agent deployment starts with data. If the data is fragmented, duplicated, or ungoverned, agents produce garbage outputs and erode user trust. Data architects who can design unified data models across Data Cloud, core Salesforce objects, and external systems are the most critical role in any Agentforce implementation.
This isn't about knowing how to create custom objects. It's about understanding data modeling at an enterprise level: master data management, data quality frameworks, golden record strategies, and cross-system identity resolution.
Agent Orchestration
Configuring a single agent is a feature. Orchestrating multiple agents across business processes is an architecture problem. The organizations deploying Agentforce successfully aren't building isolated bots. They're designing agent ecosystems where sales agents hand off to service agents, service agents escalate to human specialists, and analytics agents monitor the entire chain.
The skill here isn't prompt engineering. It's systems thinking applied to autonomous software. Understanding guardrails, escalation paths, feedback loops, and failure modes.
Governance
With 12 agents per enterprise and 50% of them operating in silos, governance is the gap that will define the next wave of Salesforce careers. Who approved this agent's access to customer data? What happens when an agent makes a decision that violates compliance policy? How do you audit an autonomous process that runs 24/7 without human oversight?
Governance isn't glamorous. But it's the skill that separates orgs that deploy agents successfully from orgs that deploy agents and then spend six months cleaning up the damage.
System Strategy
The controlled demolition of legacy Salesforce products means that system strategy — the ability to evaluate, recommend, and architect solutions across the full Salesforce platform and its alternatives — is more valuable than ever. Should this workload stay on Salesforce or move to AWS? Is Agentforce the right tool for this use case, or is a custom solution more appropriate? How do we migrate off Heroku without disrupting the 14 apps that depend on it?
System strategists who can answer these questions with data, not opinions, are the people who will lead the next generation of Salesforce implementations.
The Transition Framework
Regardless of your current role, the controlled demolition creates a specific set of moves you should be making.
If you're an Admin:
- Learn Flow inside and out. Not just screen flows. Record-triggered flows, scheduled flows, orchestration flows. Flow is the automation surface that Agentforce is built on.
- Get comfortable with permission set architecture. The profile model is dying. Permission sets and permission set groups are the future.
- Start building agents in sandbox. Not tomorrow. This week. The gap between "I've read about Agentforce" and "I've built and deployed an agent" is the gap that determines your next role.
- Focus on data quality. Agents amplify whatever data they have access to. If your data is clean, agents are powerful. If your data is messy, agents are dangerous.
If you're a Developer:
- Learn TypeScript for LWC. The beta is here. By the time it's GA, teams will expect it.
- Master Apex Cursors and the new testing frameworks. Deployment velocity is a competitive advantage, and RunRelevantTests will change how teams structure their CI/CD pipelines.
- Invest in Agentforce DX and Agent Script. The developer tooling for agents is nascent but growing fast. Early expertise here is a career accelerator.
- Think architecturally. The market doesn't need more people who can write Apex triggers. It needs people who can design agent orchestration patterns, integration architectures, and scalable data models.
If you're a Consultant:
- Shift from implementation to outcomes. The new partner program measures customer results, not project hours. Your value proposition needs to include measurable business impact, not just "we configured it."
- Build a specialization. The partner program collapsed 170 distinctions into 28 competencies for a reason. Generalist consulting is a race to the bottom. Pick a competency — Data Cloud, Agentforce, Security, Industry Solutions — and go deep.
- Develop migration expertise. Every org has legacy debt: Heroku apps, Connected Apps, legacy hostnames, profile-based security models. Migration is unglamorous, essential, and billable.
- Learn to quantify agent ROI. The clients who are buying Agentforce want to know: how many leads did the agent contact? How many opportunities did it create? What's the cost per conversation compared to a human SDR? If you can answer those questions with real data, you can sell the next engagement.
The Controlled Demolition Framework
Here's how to read what happened this week:
What was demolished:
- ~1,000 jobs tied to pre-AI organizational structures
- Five executives who built and led the pre-AI product portfolio
- Heroku, a product that represented Salesforce's 2010-era platform strategy
- The AI Associate certification, representing a "learn about AI" approach
- Legacy hostnames, Connected Apps, and Session ID patterns from a pre-modern security model
What's being built in its place:
- An agent-first organizational structure with new leadership aligned to the Agentforce vision
- Sales Cloud rebranded as Agentforce Sales, signaling that agents are the product, not an add-on
- Developer tooling (TypeScript, Apex Cursors, Agentforce DX) designed for an agent-native platform
- Admin tooling (editable data tables, error consoles, AI-powered setup) that makes Flow the center of everything
- A certification and partner program built around hands-on agent implementation, not theoretical knowledge
The demolition is real. People lost jobs. Products died. Executives left. That's not spin. That's disruption, and disruption always has a human cost.
But the blueprint is also real. Spring '26 is the most technically substantive release Salesforce has shipped in years. The tooling, the enforcements, the identity shifts — they all point in one direction. Salesforce is rebuilding itself as an agent platform, and it's moving faster than most of its ecosystem is prepared for.
The practitioners who read the blueprint and start building now will define the next era of the Salesforce ecosystem. The ones who only read the headlines will be caught in the next round of demolition.
Your move.
Have a take on the controlled demolition? Building agents already, or still migrating off legacy hostnames? Hit reply — I read every response.