The main Agentforce risks are wrong writes that nobody notices, prompt injection, permission creep and usage cost. Control them with tight permission sets, sandbox tests, human approval on writes and a four-stage rollout.
Clientell AI, the AI Salesforce admin, works on the admin side of Salesforce and asks before it changes anything in production. See how it compares in Agentforce vs third-party AI agents. Clientell AI makes one of the tools here. Clientell AI is not affiliated with Salesforce.
Why do AI agents in Salesforce need oversight?
AI agents are fast. That is the point of them, and also the risk. A person who sets Case.Status wrong usually notices after a few records. An agent with edit access on Case can repeat the same mistake across a whole queue before anyone looks.
Weak access control is a common thread in AI breaches. IBM's 2025 Cost of a Data Breach Report found that 97% of organizations with an AI-related breach lacked proper AI access controls (IBM, 2025). That is a general security study, not an Agentforce study. The lesson still holds: limit what the agent can touch.
What does Salesforce's Einstein Trust Layer cover?
The Einstein Trust Layer is the set of safety features Salesforce runs around its AI models. It includes zero data retention with partner model providers, toxicity checks and an audit trail (Salesforce Trailhead).
Those features protect data and filter output. They do not choose which records an agent may edit. They do not approve a change or undo one. Those choices stay with your team.
| Concern | Covered by the Trust Layer? | Who owns it |
|---|---|---|
| Model provider keeps your prompts | Yes, zero data retention | Salesforce |
| Toxic or harmful output | Yes, toxicity detection | Salesforce |
| Which objects and fields the agent can edit | No | Your admin, through permission sets |
| Approval before a production write | No | Your process |
| Undoing a bad write | No | Your backups and field history |
| Usage cost | No | Your usage alerts |
What are the main Agentforce risks?
| Risk | What goes wrong | First control |
|---|---|---|
| Silent writes | The agent updates Case.Status or Opportunity.Amount from weak data | Log every write, send high-impact writes to a person |
| Prompt injection | A customer email tells the agent to ignore its rules | Treat outside text as untrusted, limit actions |
| Automation edits | An agent edits a record-triggered flow with no review | Block flow edits, or require review |
| Permission creep | The agent user gains write and delete over time | Review its permission sets every quarter |
| Usage cost | A test loop burns credits | Usage alerts, small test sets |
Prompt injection is text that tries to change an AI's instructions. It is the first item, LLM01, on the OWASP Top 10 for LLM Applications. Any agent that reads customer email or chat faces it.
Usage cost is real money. Salesforce's pricing page lists Flex Credits at $500 per 100,000 credits, and 20 credits per standard action (Salesforce Agentforce pricing). Prices as of October 2026. Salesforce tracks credit use in the Digital Wallet (Salesforce Help: Flex Credits).
How do I set up Agentforce permissions safely?
- Give the agent its own user in Setup > Users > Users. Never give it the System Administrator profile.
- In Setup > Users > Permission Sets, start from a permission set with read access only to the objects it needs, such as
CaseandContact. - Add edit rights one field at a time, such as
Case.StatusandCase.Priority. Use field-level security to hide fields it should not see, such asContact.Birthdate. - Leave out "Modify All Data" and "View All Data". These two permissions override sharing rules.
- Each quarter, query
PermissionSetAssignmentfor the agent user and remove anything it has not used.
Expected result: the agent can do its one job and nothing else. If it tries to edit a field outside its scope, the save fails with an access error. That error is the control working.
How do I undo a bad agent write?
Plan the undo before the first write.
- Turn on Field History Tracking for the fields the agent edits, in Setup > Object Manager > Case > Fields & Relationships > Set History Tracking. You can track up to 20 fields per object (Salesforce Help: Field History Tracking).
- Export a backup of the records in scope before each new stage.
- When a bad write lands, query
CaseHistoryfor the field, the old value and the time of the change. Restore the old values with Data Loader from your backup. - Deactivate the agent in Agentforce Builder until you know why it wrote the wrong value. Expected result: no new writes while you fix the cause.
What is a safe Agentforce rollout plan?
Do not turn everything on at once. Use four stages.
| Stage | What the agent may do | Move on when |
|---|---|---|
| 1. Sandbox, read-only | Read records and answer questions | Answers match your real data |
| 2. Test object writes | Write only to one custom object, every action logged | Writes are correct on test records |
| 3. Production with approval | Propose changes, a person approves each one | Approvals are clean for a full business cycle |
| 4. Narrow auto-approval | Auto-approve one low-risk action, such as logging a call | You can show a clean approval history |
Use Agentforce Testing Center to run test conversations before each stage. It checks answers, not your data setup. Our post on Agentforce Testing Center vs real testing covers the gap.
When is Agentforce the right choice?
Agentforce is built for agents that talk to customers and employees inside Salesforce, such as service agents on a help site. For that use case, it is the native option.
For internal admin work, such as audits, flow fixes and permission changes, a different kind of tool may fit better. Clientell AI drafts each admin change, tests it in a sandbox and asks before it changes anything in production. Platform deployments can roll back. See our security and privacy page.
Before either, check your data and automation with the Agentforce readiness audit. Many pilots stall on data, not on the agent. Our post on why Agentforce pilots fail covers the common causes.
Try it in Clientell AI: "List the permission sets on our agent user and flag edit access it does not need."
Start the 14-day trial, no card. Need hands-on help with a rollout? See our Agentforce implementation services.
Common questions about Agentforce risks
What is the biggest Agentforce mistake on day one?
Letting the agent write to production records before you check its work on read-only tasks. Start in a sandbox.
Does Agentforce have safety features built in?
Yes. The Einstein Trust Layer covers data retention, grounding and toxicity checks. You still set permissions, tests and approvals.
Can I undo what an agent changed?
Yes, if you planned for it. Turn on Field History Tracking for the fields it edits and back up records before each stage.
Does testing Agentforce in a sandbox cost credits?
Agent actions use Flex Credits, so check the Digital Wallet while you test. Keep test sets small and set usage alerts.
How does Clientell AI handle control?
Clientell AI asks before it changes anything in production. On Clientell Platform, deployments have approval and rollback. It works on admin tasks, not customer-facing chat.
Sources
Salesforce documentation
- Meet the Einstein Trust Layer
- Agentforce Pricing
- Flex Credits Billable Usage Types
- Field History Tracking
Industry research
Last reviewed October 2026
Last updated: October 22, 2026
