Agentforce reference architecture
How Agentforce agents, Agent Script, the Atlas Reasoning Engine, the Einstein Trust Layer, Data 360 grounding, actions, MCP tools and human handoff fit together.
Agentforce is Salesforce's platform for building, testing, deploying and governing AI agents for employees and customers. An agent is only as useful as the data it is grounded in and the actions it can take, and only as safe as the controls around those actions. This page sets out a reference architecture for an Agentforce deployment, with feature status as Salesforce states it.
This is a reference design. We validate licences, permissions, data access and feature status for each implementation, and GeekMidst can design and implement it through Agentforce and AI automation.
Business context
Common starting points are service agents that answer and resolve cases with a route to a person, employee assistants in Lightning and Slack, and sales agents for inbound pipeline. Salesforce offers prebuilt agents, for example Casey (help and service) and Piper (inbound pipeline), both GA, and Hunter (outbound sales), in pilot with GA announced for November 2026. Pricing models include Flex Credits, Resolutions and per-user licensing, so cost depends on how the agent is used.
Agentforce reference architecture
Reference architecture: a reusable pattern, not a live client integration
Select a component to see what it is responsible for and how data moves to and from it.
Components and data flows (text version)
| Component | Type | Responsibility |
|---|---|---|
| Lightning and Coworkeremployees | Channel or touchpoint | Agentforce Coworker (GA) in Lightning calls your deployed agents for employees. |
| Self-service and webExperience Cloud | Channel or touchpoint | Customer-facing agents in portals and web chat. |
| SlackAgentforce in Slack | Channel or touchpoint | Agents used inside Slack channels and messages. |
| VoiceAgentforce Voice | Channel or touchpoint | Spoken conversations through Agentforce Voice and Agentforce Contact Center. |
| Agentforce agentsbuilt in Agentforce Builder | AI and agents | Agents built, tested and monitored in Agentforce Studio. New agents are created only in the new builder from July 2026. |
| Agent Scriptinstructions, actions, escalate | AI and agents | Mixes deterministic logic with LLM reasoning, including else if, system variables and escalate. |
| Atlas Reasoning Enginereasoning | AI and agents | Salesforce's reasoning engine for Agentforce, which chooses the next step within the limits set by the agent's instructions. |
| Einstein Trust Layermasking, toxicity, audit | Identity, policy and governance | Grounding, data masking, toxicity detection, audit trail and zero data retention with LLM providers. |
| Agentforce GatewayMCP usage policies | Identity, policy and governance | Sets MCP usage policies per agent and tool, such as call-volume limits, and provides monitoring. |
| User permissionsCRUD, FLS, sharing | Identity, policy and governance | Actions run within Salesforce permissions. Building agents needs the Manage AI Agents permission. |
| Human agentsqueues and teams | People | People who take over when the agent escalates, with the conversation context. |
| Data 360 groundingAgent Context Engine | Data and analytics | Unified profiles and related data used to ground answers. Agent Memory's status is not stated by Salesforce. |
| Flow actionsdeclarative | Salesforce product | Flows exposed as agent actions for record updates and business processes. |
| Apex actionsinvocable methods | Salesforce product | Apex for logic Flow cannot express, with tests and bulk safety. |
| MCP toolsMCP client: beta | Integration layer | Allowlisted tools from registered MCP servers become actions in the Asset Library. Beta since January 2026. |
| Salesforce recordsSales and Service Cloud | Salesforce product | Cases, accounts and opportunities that agents read and update. |
| External MCP serversregistered and allowlisted | External or custom system | Third-party or MuleSoft servers registered through the Agentforce Registry or API Catalog. |
| Observability and testinghealth, scorers, tests | Identity, policy and governance | Agentforce Observability, Agent Health Monitoring (GA), Custom Scorers and Voice and Conversation Testing (beta). |
Data flows
- Lightning and Coworker → Agentforce agents: employee requests. Requests from Coworker reach the agent with the user's identity.
- Self-service and web → Agentforce agents: customer messages. Customer messages reach a service agent; guest access needs a separate permission review.
- Slack → Agentforce agents: Slack messages. Messages from Slack reach the agent with the Slack user's mapped identity.
- Voice → Agentforce agents: speech. Voice is transcribed for the agent and responses are spoken back.
- Agentforce agents → Agent Script: instructions. The agent follows Agent Script; deterministic steps run as written.
- Agent Script → Atlas Reasoning Engine: reasoning steps. Atlas chooses which action to take next within the script's limits.
- Atlas Reasoning Engine → Einstein Trust Layer: LLM calls. Prompts and responses pass through the Trust Layer for masking, toxicity checks and audit.
- Atlas Reasoning Engine → User permissions: action requests. Each action runs within the running user's permissions.
- Atlas Reasoning Engine → Agentforce Gateway: MCP tool calls. Calls to MCP tools pass through Agentforce Gateway policies such as call-volume limits.
- Einstein Trust Layer → Data 360 grounding: grounding. Relevant data is retrieved and masked before reaching the model.
- User permissions → Flow actions: run Flow. Flow actions run declarative logic; errors are returned to the agent.
- User permissions → Apex actions: run Apex. Apex actions run with tests and error handling; failures are logged.
- Agentforce Gateway → MCP tools: allowlisted tools. Only tools an admin has allowlisted are available.
- Flow actions → Salesforce records: record updates. Flows create or update records under the user's permissions.
- Apex actions → Salesforce records: complex updates. Apex updates records that need more logic.
- MCP tools → External MCP servers: remote tool calls. Authenticated with OAuth client credentials or per-user named and external credentials.
- Agent Script → Human agents: escalate. Agent Script's escalate routes the conversation to a human with context.
- Salesforce records → Observability and testing: outcomes. Session traces, action results and record outcomes such as resolved cases feed observability and testing.
Component responsibilities
| Component | Responsible for | Status (as Salesforce states it) |
|---|---|---|
| Agentforce Builder in Agentforce Studio | Building, testing and monitoring agents | Only builder for new agents from the week of 13 July 2026 |
| Agent Script | Hybrid deterministic and LLM logic | Updated in Winter '27 |
| Atlas Reasoning Engine | Choosing the next step and action | Current component |
| Einstein Trust Layer | Masking, toxicity detection, audit, zero data retention | Current; some copy says Agentforce Trust Layer |
| Multi-Agent Orchestration | Agents handing work to other agents | GA |
| Flow and Apex actions | Business logic and record changes | Platform features |
| MCP tools | Tools from external MCP servers | Beta (15 January 2026); GA not confirmed |
| Agent Optimizer | Improving agent performance | GA announced for October 2026 |
Data flow, step by step
- A request arrives from Lightning, a portal, Slack or voice, with the user's identity.
- The agent follows Agent Script, running deterministic steps and using Atlas for reasoning.
- Model calls pass through the Einstein Trust Layer, which masks data, checks toxicity and keeps an audit trail.
- The agent grounds its answer in CRM records and Data 360 data the user is allowed to see.
- The agent takes actions through Flow, Apex or allowlisted MCP tools, each within permissions and Gateway policies.
- The agent escalates to a person when the script says so.
- Outcomes are monitored through observability and testing tools.
Trust boundaries and authentication
The main boundary is your org: agents act within user permissions, CRUD, field-level security and sharing. Customer-facing agents cross the public boundary, so review guest access carefully. MCP tools cross a third boundary to external servers: admins register servers in Setup, allowlist tools, and connect with OAuth client credentials or per-user named and external credentials. Salesforce says the Einstein Trust Layer and zero data retention apply to MCP tool use. Our Agentforce and MCP page covers this in detail.
Failure scenarios and how to handle them
| Failure | Effect | How to handle it |
|---|---|---|
| Agent gives a wrong answer | Customer misled | Ground in governed data; test with scorers; escalate when unsure |
| Action fails | Task incomplete | Return a clear error and offer a human |
| Agent over-permissioned | Data exposure | Least-privilege agent user and permission review |
| MCP server down or slow | Tool unavailable | Timeouts and a fallback message |
| Escalation loses context | Customer repeats themselves | Pass the transcript and key fields on escalate |
Operational monitoring
Use Agentforce Observability and Agent Health Monitoring for health and errors, and Voice Observability (GA) for voice. Review conversations weekly, measure escalation and resolution rates, and run regression tests before changes. Custom Scorers have a GA API and a beta UI; A/B Experimentation for agents is beta. See agent testing and guardrails.
Alternative approaches and trade-offs
Prebuilt agents start faster but follow Salesforce's design. Custom agents fit your process but need more testing. MCP tools reuse external capabilities but add a dependency and are beta. Flow or Apex actions keep logic in your org and are easier to govern.
Implementation checklist
- 01
Pick one use case
A narrow, measurable first agent
- 02
Confirm licences
Flex Credits, Resolutions or per-user licensing, and Data 360 if grounding uses it
- 03
Prepare data
Clean, permissioned data for grounding
- 04
Design actions
Flow or Apex first; MCP tools only where needed
- 05
Write Agent Script
Instructions, deterministic steps and escalate rules
- 06
Test
Scorers and conversation tests before launch
- 07
Plan handoff
Queues, context passing and staffing
- 08
Monitor
Health, escalation rate and errors with an owner
Related services and solutions
Agentforce and AI automation
Agent design and build
→Agentforce testing and governance
Testing and guardrails
→Service agent with human handoff
A solution design
→Agentforce and MCP
Connecting agents to MCP tools
→MCP security architecture
Authorisation and tool controls
→Data 360 architecture
Grounding data
→Questions we hear
Is this from a client deployment?
Can Agentforce call external MCP servers?
Do agents bypass Salesforce permissions?
How do customers reach a person?
Sources
- https://www.salesforce.com/agentforce/
- https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_builder_studio.htm&type=5
- https://developer.salesforce.com/docs/ai/agentforce/guide/trust.html
- https://www.salesforce.com/blog/agentforce-mcp/
- https://trailhead.salesforce.com/content/learn/modules/mcp-for-agentforce-quick-look/discover-mcp-for-agentforce
- https://www.salesforce.com/news/stories/agentforce-job-ready-ai-agents/
Plan your Agentforce architecture
Tell us the use case you have in mind. We can propose an agent design with grounding, actions, controls and handoff.
