Enterprise AI Integration with Salesforce
Connecting Salesforce data and actions to AI agents and assistants safely: permissions first, read before write, humans in the loop and measured quality.
AI agents and assistants are only useful when they can reach your data and take action. They are only safe when that access is governed: the right user's permissions, read before write, human confirmation for changes, and evidence of what happened. Enterprise AI integration is the work of making both true at once.
This page covers connecting Salesforce to AI: Agentforce, the Einstein Trust Layer, MCP servers from Salesforce and other vendors, grounding, guardrails, evaluation, escalation and governance. For the agent platform itself, see Agentforce and AI automation.
The business problem
Teams want agents that answer from real customer data and AI assistants that can look up records. Without design, this becomes shared service accounts, broad API scopes and no record of who asked for what. The risk is not only data exposure; it is confident answers from stale or partial data, and actions nobody approved.
Proposed architecture
This is a reference design. We validate server availability, licences and permissions for each implementation. See also the Agentforce architecture and MCP security and authorisation.
Enterprise AI integration reference architecture
Reference architecture: a reusable pattern, not a live client integration
Select a component to see what it is responsible for and how data moves to and from it.
Components and data flows (text version)
| Component | Type | Responsibility |
|---|---|---|
| Employees and customersin Salesforce or AI clients | People | Ask questions and request actions through agents or approved AI clients. |
| Agentforce agentAgentforce Builder | AI and agents | Built in Agentforce Builder with Agent Script, mixing deterministic steps with LLM reasoning. |
| Einstein Trust Layermasking, audit | Identity, policy and governance | Grounding, data masking, toxicity detection, audit trail and zero data retention with LLM providers. |
| External AI clientMCP host | AI and agents | An approved MCP host, such as a desktop assistant, registered with OAuth. |
| Agent actionsFlow, Apex, prompts | Salesforce product | Flows, Apex and prompt templates the agent may call, each scoped by permissions. |
| Salesforce Hosted MCPGA; Flex Credits | Salesforce product | Salesforce-hosted MCP servers, GA 29 Apr 2026; each call runs as the signed-in user. |
| MCP registry and gatewayAgentforce or MuleSoft | Identity, policy and governance | Registers external servers, allowlists tools and applies usage policies. |
| Salesforce CRMCRUD, FLS, sharing enforced | Salesforce product | Records the agent reads and, with confirmation, updates. |
| Data 360profiles, insights | Data and analytics | Unified profiles and insights used for grounding. |
| Vendor MCP serverse.g. MC Engagement, Braze | External or custom system | Vendor-run servers with their own status and auth, such as Marketing Cloud Engagement or Braze. |
| Human reviewapproval and handoff | People | Staff who confirm write actions and take escalated conversations. |
Data flows
- Employees and customers → Agentforce agent: requests. Conversation in Salesforce, Slack or a portal. The agent runs with the user's or agent's permissions.
- Agentforce agent → Einstein Trust Layer: prompts and responses. Masking and toxicity checks on the way out and back; audit trail retained.
- Agentforce agent → Agent actions: tool calls. The agent calls only the actions assigned to it. Failures return an error the agent must handle.
- Agentforce agent → MCP registry and gateway: external tools. Allowlisted MCP tools only. The gateway can cap call volumes per agent and tool.
- External AI client → Salesforce Hosted MCP: OAuth with PKCE. External Client App with the mcp_api and refresh_token scopes, PKCE required. A new app can take up to 30 minutes to become active.
- Agent actions → Salesforce CRM: read and update. Reads first. Updates run only after user confirmation where the action changes data.
- Agent actions → Data 360: grounding. Profile and insight lookups for context. Stale profiles mean stale answers.
- Salesforce Hosted MCP → Salesforce CRM: SObject tools. Prefer the read-only SObject Reads server; mutations need confirmation.
- MCP registry and gateway → Vendor MCP servers: vendor tools. Calls under the vendor's auth and limits. Destructive tools stay disabled unless approved.
- Agent actions → Human review: escalation. Agent Script supports escalate. Handoff includes the conversation and context.
Component responsibilities
| Component | Responsibility |
|---|---|
| Agentforce agent | Reasoning and conversation; built in Agentforce Builder with Agent Script |
| Einstein Trust Layer | Grounding, masking, toxicity detection, audit trail, zero data retention with LLM providers |
| Agent actions | The specific Flows, Apex and prompt templates an agent may use |
| Salesforce Hosted MCP Servers | Governed MCP access to Salesforce for approved AI clients |
| MCP registry and gateway | Registration, tool allowlists and usage policies |
| Human review | Confirmation of write actions and handling of escalations |
Agentforce and the Trust Layer
Agentforce is Salesforce's platform for building, testing, deploying and governing AI agents. Since the week of 13 July 2026, new agents are created only in the new Agentforce Builder, which uses Agent Script to mix deterministic logic with LLM reasoning; legacy agents keep running. The Einstein Trust Layer, also called the Agentforce Trust Layer in some 2026 newsroom copy, provides grounding in CRM data, data masking, toxicity detection, an audit trail and zero data retention agreements with LLM providers. Salesforce says the Trust Layer and zero data retention also apply to MCP tool use in Agentforce.
MCP: vendor servers and their status
Vendor MCP servers, as each vendor states
| Server | Publisher | Status |
|---|---|---|
| Salesforce Hosted MCP Servers | Salesforce | GA 29 Apr 2026; Enterprise Edition and above; intended for customers with Flex Credits |
| Headless 360 MCP Server | Salesforce | Beta |
| Data 360 MCP Server | Salesforce | Generally available, per Salesforce news of 19 Aug 2026 |
| Marketing Cloud Engagement MCP Server | Salesforce | GA 2 Jun 2026 |
| Agentforce as an MCP client | Salesforce | Beta from 15 Jan 2026; GA status not confirmed |
| Braze MCP Server | Braze | Generally available, per Braze article of 23 Jul 2026 |
| MuleSoft MCP Bridge | MuleSoft | GA, mid-year release 12 Aug 2026 |
Hosted MCP servers authenticate through an External Client App with the mcp_api scope and PKCE, run every call as the signed-in user, and enforce CRUD, field-level security and sharing. Standard servers are disabled until an admin enables them. Salesforce recommends an MCP gateway, such as MuleSoft AI Gateway, for cross-vendor governance. Any GeekMidst adapter for these products would be a proposed design, not an existing product. See MCP integrations and Agentforce and MCP.
The GeekMidst pattern
Our own website MCP server shows the pattern we recommend: public and read-only, every tool annotated read-only, rate limited per address, with origin validation and an anonymous request log that stores no arguments. It serves only published website content and does not connect to Salesforce or any client system. For business systems, we start the same way: read-only tools first, then write tools behind human confirmation.
Retrieval and grounding
Ground answers in governed sources: CRM records through actions, Data 360 profiles and insights, and knowledge articles. Retrieval runs with the user's permissions, so an agent cannot reveal what the user could not see. Never give an AI direct database credentials or unrestricted SQL; expose specific, scoped tools instead.
Guardrails
- Assign each agent only the actions it needs.
- Separate read tools from write tools, and require human confirmation for writes.
- Keep destructive tools disabled unless there is an approved case.
- Allowlist MCP tools in the registry; only allowlisted tools reach agents.
- Cap call volumes per agent and tool through the gateway.
Evaluation
Test agents before and after release. Salesforce offers Agentforce Observability; Custom Scorers (API GA, UI Beta); Voice and Conversation Testing (Beta); and A/B Experimentation for agents (Beta). Agent Optimizer was announced as GA in October 2026. Build a test set of real questions with expected outcomes and run it on every change; see agent testing and guardrails.
Human escalation
Agent Script supports escalate. Define when an agent must hand off: low confidence, sensitive topics, failed actions or customer request. The handoff should carry the conversation and context. See Agentforce service agent with human handoff.
Governance
Keep an inventory of agents, tools and MCP servers with owners. Review permissions quarterly. Winter '27 adds MCP Risk Scores in Security Center, described as GA in the platform blog. Read our responsible AI statement for how we work.
Deployment model
We build in sandboxes first, working remotely from India, and promote agents and MCP Server Definitions through your release process.
Implementation stages
- 01
Choose use cases
Start with read-only, low-risk questions with clear value.
- 02
Map access
Define the data and actions each use case needs, per role.
- 03
Build read tools
Ground the agent; expose read-only tools first.
- 04
Evaluate
Test with real questions; measure accuracy and escalation.
- 05
Add write tools
Behind human confirmation, one at a time.
- 06
Govern
Inventory, review and monitor continuously.
Testing strategy
Test with each role's permissions, not an administrator's. Include adversarial prompts, requests for data the user should not see, and failure of every tool.
Operational monitoring
Track conversations, tool calls, errors, escalations and Trust Layer events. Investigate spikes in tool errors or escalations promptly.
Prerequisites and limitations
Salesforce says every customer can start with Agentforce through Salesforce Foundations, with commercial models of Flex Credits, Resolutions or per-user licensing. Hosted MCP servers are intended for customers with Flex Credits. Vendor servers need each vendor's licence and permissions.
Related
Agentforce testing and governance
Evaluation and controls
→MCP integration consulting
Designing MCP access
→MCP security and governance
Controls for MCP
→AI readiness assessment
Check your starting point
→Questions we hear
Can an AI assistant connect straight to our Salesforce data?
Does GeekMidst have an MCP server for Salesforce?
How are write actions controlled?
Is Agentforce MCP client support GA?
Sources
- https://www.salesforce.com/agentforce/
- https://developer.salesforce.com/docs/ai/agentforce/guide/trust.html
- https://developer.salesforce.com/blogs/2026/04/salesforce-hosted-mcp-servers-are-now-generally-available
- https://www.salesforce.com/blog/agentforce-mcp/
- https://developer.salesforce.com/blogs/2026/06/the-mcp-server-for-marketing-cloud-engagement-is-now-ga
- https://www.braze.com/resources/articles/braze-mcp-server
Connect AI to Salesforce safely
We can scope a read-only first use case and the governance it needs.
