Skip to content

Agentforce Architecture

Agentforce is Salesforce’s autonomous AI agent platform and the company’s biggest strategic push. It allows organizations to deploy AI agents that reason, plan, and take actions within Salesforce. As the fastest-growing organic product in Salesforce history (18,500+ customers by early 2026), Agentforce is increasingly expected to appear in CTA scenarios. A CTA must understand the architecture deeply — not just what it does, but when to recommend it, when to avoid it, and how to defend that decision before the review board.

Why This Matters for CTA

Agentforce has been added to the Salesforce Admin exam as of December 2025 and is rapidly entering CTA scenario discussions. Review boards now expect candidates to consider AI agents as part of the solution landscape. You do not need to recommend Agentforce in every scenario, but you must demonstrate you evaluated it and can articulate why it does or does not fit.

Atlas Reasoning Engine

The Atlas Reasoning Engine is the core of Agentforce. It implements System 2 reasoning — deliberate, step-by-step analysis rather than fast pattern matching. This distinction is architecturally significant: Atlas does not just generate text — it plans, acts, observes, and reflects in a loop until the goal is met.

The ReAct Reasoning Loop

Atlas uses a Reason-Act-Observe (ReAct) cycle. Salesforce’s engineering team confirmed through extensive experimentation that ReAct-style prompting yields significantly better results than Chain-of-Thought (CoT) alone.

flowchart TD
    A["User Query"] --> B["Topic Classification<br/>(intent detection across defined topics)"]
    B --> C["RAG: Data Retrieval<br/>(Data Cloud, Knowledge, CRM records)"]
    C --> D["Augmented Prompt Assembly<br/>(query + retrieved data + topic instructions + guardrails)"]
    D --> E["LLM Reasoning — Plan<br/>(System 2: step-by-step plan generation)"]
    E --> F{"Plan sufficient?"}
    F -->|"No — needs more data"| C
    F -->|"Yes"| G["Action Selection<br/>(choose Flow, Apex, API, MuleSoft, or Prompt)"]
    G --> H["Action Execution<br/>(deterministic execution within Salesforce)"]
    H --> I["Observe Results<br/>(evaluate action output)"]
    I --> J{"Goal achieved?"}
    J -->|"No — refine plan"| E
    J -->|"Yes"| K["Self-Reflection & Validation<br/>(check against guardrails + toxicity)"]
    K --> L{"Passes all<br/>guardrails?"}
    L -->|"No"| M["Escalate to Human Agent"]
    L -->|"Yes"| N["Response to User"]
    N --> O["Audit Trail Logged<br/>(full interaction recorded)"]

    style B fill:#264653,stroke:#1d3640,color:#fff
    style C fill:#2a9d8f,stroke:#21867a,color:#fff
    style E fill:#1a535c,stroke:#0d3b44,color:#fff
    style H fill:#2d6a4f,stroke:#1b4332,color:#fff
    style K fill:#e76f51,stroke:#c45a3f,color:#fff
    style M fill:#9d0208,stroke:#6a040f,color:#fff

Atlas Architecture Internals

ComponentRoleArchitectural Significance
PlannerTranslates user goals into step-wise plans using the LLMEnables multi-step reasoning, not single-shot responses
Action SelectorDetermines which tool/action to invoke based on the planBridges AI reasoning with deterministic Salesforce execution
Tool Execution EngineDynamically invokes actions (Flows, Apex, APIs)Actions execute within Salesforce governor limits and security model
Memory ModuleMaintains conversation history and contextEnables multi-turn conversations with context retention
Reflection ModuleEvaluates results and retries/optimizes if neededSelf-correction reduces hallucination and improves accuracy

Async, Event-Driven Design

Atlas uses an asynchronous, event-driven architecture internally. It adopts a publish-subscribe pattern that decouples component nodes. Agent roles, behaviors, and states are defined declaratively via YAML configuration, allowing engineers to define agents without extensive code.

Agent Component Model

Every Agentforce agent is composed of four core building blocks: Topics, Actions, Instructions, and Guardrails. Understanding their relationships is essential for designing effective agents.

Topics

Topics are the foundation — they define what an agent can do and scope its behavior to specific business domains. The Atlas reasoning engine detects user intent and routes to the matching topic.

Topic ElementPurposeExample
Classification DescriptionTells the engine when to activate this topic”Use when customer asks about order status or shipping”
ScopeDefines what the agent can do within this topic”Can look up orders, check tracking, initiate returns”
InstructionsDetailed behavioral guidance and business rules”Always verify customer identity before sharing order details”
ActionsThe specific tasks the agent can executeFlow: Get Order Status, Apex: Calculate Refund

Topic Design Best Practice

Salesforce recommends no more than 15 actions per topic. Too many actions create ambiguity for the reasoning engine and degrade response quality. Design narrow, focused topics rather than broad catch-all topics.

Action Types

Actions are the executable tasks agents perform. They bridge AI reasoning with deterministic Salesforce automation.

Action TypeWhen to UseStrengthsLimitations
Flow ActionsDeclarative business logic, admin-maintained processesLow-code, reuses existing Flows, fast to deployLimited to Flow capabilities
Apex ActionsComplex calculations, custom logic, bulk operationsFull programmatic control, deterministic resultsRequires developer, code maintenance
MuleSoft API ActionsCross-system integration, external data retrievalConnects to any system via APIs and connectorsRequires MuleSoft licensing and expertise
Prompt Template ActionsPersonalized text generation, summaries, recommendationsAI-generated content grounded in CRM dataNon-deterministic output
External Service ActionsSimple REST API calls with OpenAPI specNo-code API integration from within FlowsLimited to APIs with OpenAPI specs

Guardrails

Guardrails constrain agent behavior and enforce safety boundaries. They operate at multiple levels.

Guardrail TypeWhat It ControlsExample
Topic-level instructionsScope boundaries per domain”Never discuss competitor products”
Ethical guardrailsPrevent harmful/biased outputsToxicity detection, bias filtering
Security guardrailsPrevent prompt injection and data leakageInput sanitization, PII masking
Escalation rulesDefine when to hand off to humans”Escalate if customer sentiment is negative after 3 turns”
Action constraintsLimit what actions can be triggered”Cannot issue refunds over $500 without human approval”

Einstein Trust Layer

The Trust Layer is the enterprise-grade security architecture that makes Agentforce production-ready. It is not optional — every Agentforce interaction passes through it.

flowchart LR
    A["User Prompt"] --> B["PII/PCI/PHI Masking<br/>(named entity detection)"]
    B --> C["Secure Data Retrieval<br/>(RAG via Data Cloud)"]
    C --> D["Dynamic Grounding<br/>(augment with CRM data)"]
    D --> E["LLM Processing<br/>(zero-retention gateway)"]
    E --> F["Toxicity Detection<br/>(scan response for harmful content)"]
    F --> G["De-masking<br/>(restore masked entities)"]
    G --> H["Audit Trail Logged<br/>(full interaction metadata stored)"]
    H --> I["Response to User"]

    style B fill:#e76f51,stroke:#c45a3f,color:#fff
    style E fill:#264653,stroke:#1d3640,color:#fff
    style F fill:#e76f51,stroke:#c45a3f,color:#fff
    style H fill:#f4a261,stroke:#d4823e,color:#000
Trust Layer FeatureWhat It DoesCTA Significance
PII MaskingSubstitutes sensitive data with placeholders before LLM processingMeets GDPR/CCPA/HIPAA requirements for data minimization
Zero Data RetentionLLM providers (OpenAI, etc.) never store prompt or response dataContractual guarantee — data is wiped after response generation
Toxicity DetectionScans both input prompts and AI responses for harmful contentPrevents brand-damaging or offensive agent behavior
Dynamic GroundingAugments prompts with real Salesforce data to reduce hallucinationAccuracy depends on data quality in Data Cloud
Audit TrailLogs every interaction including original prompt, masked prompt, toxicity scoresStored in Data 360 for compliance and analytics
Prompt DefenseDetects and blocks prompt injection attacksPrevents users from manipulating the agent into unauthorized actions

CTA Board Question: “How does the Trust Layer protect customer data?”

Model answer: “Every prompt passes through the Einstein Trust Layer before reaching the LLM. PII, PCI, and PHI data is masked using named entity detection. The LLM operates under a zero-retention agreement — no customer data is stored or used for model training. Responses are scanned for toxicity before delivery. Every interaction is logged in an audit trail in Data 360, providing the compliance team full visibility. This architecture means the customer’s data never leaves Salesforce’s security perimeter in an unprotected form.”

Data Cloud Integration and RAG

Agentforce’s intelligence depends on Data Cloud for retrieval-augmented generation (RAG). Without Data Cloud, agents cannot access the unified customer context that makes them effective.

How RAG Works in Agentforce

  1. Retrieval — The system searches Data Cloud’s unified data graph (structured CRM data + unstructured content processed by Data 360) to find relevant context for the user’s query
  2. Augmentation — Retrieved data is injected into the LLM prompt alongside the user query, topic instructions, and guardrails
  3. Generation — The enriched prompt is sent to the LLM, producing a response grounded in real customer data rather than generic training data

Data Sources Available to Agents

Data SourceAccess MethodUse Case
CRM RecordsDirect Salesforce queriesAccount, Contact, Case, Opportunity data
Knowledge ArticlesKnowledge base searchFAQ resolution, product information
Data Cloud Unified ProfileRAG via Data 360Cross-system customer context
Unstructured ContentVector search via Data 360PDFs, emails, chat transcripts, documents
External SystemsMuleSoft API actionsERP data, inventory, external databases

Data Cloud Dependency

Data Cloud is strongly recommended for advanced RAG use cases, but basic agents can function with direct CRM queries and Knowledge articles without Data Cloud. However, without Data Cloud, agents lack the unified cross-system context needed for sophisticated RAG grounding. In a CTA scenario, if the customer requires complex data unification or unstructured content search, you must factor the Data Cloud implementation into your timeline, budget, and architecture.

Agent Types Comparison

Agent TypePrimary Use CaseKey ActionsWhen to Recommend
Service AgentCase deflection, customer self-serviceKnowledge search, case creation, order lookup, escalationHigh-volume service orgs needing 24/7 coverage
Sales Agent (SDR)Lead qualification, outreach, pipeline generationLead research, email drafting, meeting schedulingLarge lead volumes with limited SDR headcount
Marketing AgentCampaign execution, segmentation, personalizationAudience building, content generation, journey optimizationMarketing teams wanting AI-driven campaign execution
Commerce AgentProduct discovery, shopping assistanceIntent-aware search, product recommendations, cart assistanceB2C commerce sites needing guided shopping
Contact Center AgentUnified voice + digital channel handlingOmnichannel routing, real-time transcription, agent assistMulti-channel contact centers (GA, rolling out progressively since early 2026)
Industry AgentsVertical-specific workflowsVaries by industry (claims, quoting, care coordination)Financial Services, Automotive, Manufacturing orgs
Custom AgentAny business-specific workflowUser-defined topics and actionsUnique processes not covered by pre-built agents

Agent Builder Configuration

Agent Builder is the low-code tool for building and configuring Agentforce agents. The new agent building experience became generally available in February 2026.

Configuration Workflow

  1. Select Agent Type — Choose a pre-built agent or create from scratch. The agent type determines available topics and actions
  2. Define Topics — Create topics with classification descriptions, scope, and instructions. Each topic represents a domain the agent handles
  3. Assign Actions — Map Flow, Apex, MuleSoft, or Prompt Template actions to each topic (max 15 actions per topic recommended)
  4. Set Guardrails — Define escalation rules, action constraints, and behavioral boundaries
  5. Test in Conversation Preview — Simulate conversations and inspect the plan canvas to see which topics, actions, and reasoning the agent used
  6. Deploy — Activate on channels (web chat, WhatsApp, Slack, Experience Cloud, voice)

Natural Language Agent Creation

Agentforce 2.0+ supports interpreting natural language instructions like “Onboard New Product Managers” to auto-generate agents. These agents combine pre-built skills with custom logic, but always review and refine the generated configuration before production deployment.

Licensing and Cost Model

Agentforce pricing has evolved significantly since launch. A CTA must understand the cost model to evaluate ROI.

Pricing ModelHow It WorksBest ForCost
ConversationsFlat fee per completed conversationExternal-facing customer agents with predictable volume~$2/conversation
Flex CreditsConsumption-based; each action = 20 creditsAny Agentforce use case; pay for what you use$0.10/action (packs of 100K credits for $500)
Per-User LicensingMonthly fee per user for AI capabilitiesAgentforce add-ons ($125/user/mo) or Editions ($550+/user/mo)$125-$550+/user/month (approximate — verify current pricing at salesforce.com/agentforce as pricing evolves rapidly)

Pricing Constraints

Credits and Conversations cannot be combined in the same org — each org must choose one pricing model. Factor this into multi-use-case architectures. Also budget for Data Cloud licensing as a prerequisite.

CTA Board Question: “What’s the cost model and ROI justification?”

Model answer: “Agentforce uses consumption-based pricing. For the service use case, at $2 per conversation, if we deflect 10,000 cases per month that currently cost $15 each in agent time, the monthly cost is $20,000 against $150,000 in savings — a 7.5x ROI. However, we must also factor Data Cloud licensing, implementation costs, and the ongoing tuning effort. I would recommend a 90-day pilot with 2-3 topics to validate deflection rates before committing to full rollout. Real-world results show 40-70% case deflection rates for well-configured agents.”

Agentforce vs Einstein Bots vs Flow

This is a critical decision matrix for CTA scenarios. These are complementary tools, not competitors.

FactorAgentforceEinstein BotsFlow Automation
IntelligenceLLM-powered reasoning, multi-step planningRule-based NLU, keyword matchingDeterministic logic, no NLU
ConversationsNatural language, context-awareScripted dialog treesNo conversational interface
AutonomyAutonomous multi-step executionFollows predefined pathsExecutes predefined logic
Data accessRAG via Data Cloud + CRMKnowledge articles, CRM queriesDirect CRM queries
Complexity handledHigh (ambiguous, multi-step)Low-Medium (structured queries)Medium (rule-based branching)
Setup effortMedium (topics, actions, testing)Medium (intents, dialogs)Low (declarative builder)
Cost$2/conversation or flex creditsIncluded in Service CloudIncluded in platform
MaintenanceOngoing tuning, monitoringIntent training updatesStandard Flow maintenance
Best forComplex customer interactions needing reasoningHigh-volume simple FAQ deflectionInternal automation, no user dialog

Decision Flowchart: When to Use What

flowchart TD
    Start(["Customer Interaction<br/>Automation Need"]) --> Q1{"Requires natural<br/>language understanding?"}
    Q1 -->|"No"| R1["Flow/Apex Automation<br/>(deterministic, no conversation)"]
    Q1 -->|"Yes"| Q2{"Multi-step reasoning<br/>or ambiguous queries?"}
    Q2 -->|"No"| Q3{"High volume,<br/>simple FAQ-style?"}
    Q3 -->|"Yes"| R2["Einstein Bots<br/>(cost-effective for simple deflection)"]
    Q3 -->|"No"| R3["Agentforce — Single Topic<br/>(focused AI agent)"]
    Q2 -->|"Yes"| Q4{"Data Cloud available<br/>or justified?"}
    Q4 -->|"No"| R4["Flow + Apex + Custom LWC<br/>(avoid AI dependency)"]
    Q4 -->|"Yes"| Q5{"Existing Flows/Apex<br/>reusable as actions?"}
    Q5 -->|"Yes"| R5["Agentforce with<br/>Existing Actions"]
    Q5 -->|"No"| R6["Phased: Build Actions First<br/>then Add Agentforce"]

    style R1 fill:#2d6a4f,stroke:#1b4332,color:#fff
    style R2 fill:#4ecdc4,stroke:#3ab5ad,color:#000
    style R3 fill:#1a535c,stroke:#0d3b44,color:#fff
    style R4 fill:#f4a261,stroke:#d4823e,color:#000
    style R5 fill:#1a535c,stroke:#0d3b44,color:#fff
    style R6 fill:#f4a261,stroke:#d4823e,color:#000

Security and Sharing Model

Agentforce respects the Salesforce security model. Agents do not bypass permissions — they aggressively use whatever access the running user already has.

Security AspectHow It WorksCTA Implication
User contextAgent inherits the permissions of the Salesforce user it runs asEach Agent User should be unique and follow least-privilege
Sharing modelAgent respects role hierarchy, sharing rules, OWD settingsData visibility matches what that user would see in the UI
Field-level securityAgent can only read/write fields the user has access toFLS misconfigurations can cause silent agent failures
CRUD permissionsAgent can only perform CRUD operations the user is authorized forPermission sets must be carefully scoped for agent users
Attribute-based policiesFine-grained rules beyond RBAC (e.g., “Only EU sales agents can trigger pricing workflows”)Supports complex regulatory requirements

CTA Board Question: “How does the agent respect data access controls?”

Model answer: “Agentforce agents inherit the permissions and sharing rules of the Salesforce user they run as. They do not bypass the security model — if the user cannot see a record, the agent cannot see it either. We create a dedicated Agent User with a permission set following least-privilege principles. The agent can only access objects and fields explicitly granted. For external-facing agents, we use a guest user profile with the minimum permissions needed. This aligns with Salesforce’s shared responsibility model.”

Testing and Monitoring

Agent quality requires systematic testing and production monitoring. Salesforce provides several tools.

ToolPurposeWhen to Use
Conversation PreviewManual testing in Agent Builder; inspect plan canvas and reasoningDuring development and topic configuration
Testing CenterBatch testing; simulate hundreds of interactions in one runPre-deployment validation, regression testing
Enhanced Event LogsCapture full interaction details for debuggingTroubleshooting specific conversation failures
Agent Health MonitoringReal-time dashboards tracking error rate and latencyProduction monitoring with 5-minute interval metrics
Agentforce Command CentreUnified dashboard for all production agentsEnterprise-scale agent fleet management
Utterance AnalysisAnalyze conversation patterns and unhandled intentsOngoing optimization and topic gap identification

Key Metrics to Track

MetricWhat It MeasuresTarget
Deflection rate% of conversations resolved without human handoff40-70% for well-configured agents
Error rate% of agent responses that fail<5%
Average interaction latencyTime from request to response<3 seconds
Escalation rate% of conversations escalated to humanTrack trend — should decrease over time
Customer satisfactionPost-conversation CSAT scoreAt or above human agent baseline

CTA Board Question: “How do you test and monitor agent quality?”

Model answer: “We test at three levels. First, manual testing in Conversation Preview during development to validate topic routing and action execution. Second, batch testing in Testing Center before deployment to simulate hundreds of scenarios and catch regressions. Third, production monitoring via Agent Health Monitoring dashboards tracking error rate, latency, and deflection rate at 5-minute intervals. We also use Utterance Analysis to identify unhandled intents and feed those back into topic design. The Command Centre gives leadership a unified view across all agents.”

CTA Scenario Use Cases

Scenario 1: Service Deflection

Situation: A telecom company handles 50,000 cases/month. 60% are routine (billing inquiries, plan changes, outage status). Average cost per agent-handled case is $12.

Recommendation: Deploy Agentforce Service Agent with three topics: Billing Inquiries, Plan Management, and Outage Status. Expose existing Flows (Get Bill Summary, Change Plan, Check Outage Map) as agent actions.

Expected outcome: 40-50% deflection rate = 20,000-25,000 fewer agent-handled cases/month. At $2/conversation vs $12/case, monthly savings of $200K-$250K against $50K in agent costs.

Why not Flow alone? Customers describe problems in natural language (“my bill is too high” vs “I want to see my last 3 invoices”). The agent must interpret intent, not just follow a decision tree.

Scenario 2: Sales Lead Qualification

Situation: A B2B SaaS company receives 5,000 inbound leads/month. Their 10-person SDR team can only touch 2,000. The rest go cold.

Recommendation: Deploy Agentforce SDR Agent to research and qualify all inbound leads using Data Cloud unified profiles. Agent drafts personalized outreach and schedules meetings for qualified leads.

Expected outcome: Based on Salesforce’s internal deployment, SDR agents generated $1.7M in new pipeline from dormant leads in one year. The agent handles initial qualification; human SDRs focus on high-value conversations.

Scenario 3: Multi-Channel Commerce

Situation: A retailer needs consistent customer experience across web chat, WhatsApp, and mobile app. Current support is fragmented across channels.

Recommendation: Deploy Agentforce Contact Center (GA, rolling out progressively since early 2026) with unified voice + digital channel handling. Agent maintains conversation context across channels and hands off to human agents with full history.

Trade-off: This is a newer capability (early maturity). Mitigate with phased rollout: start with web chat, add WhatsApp after 60 days, add voice after 120 days.

Scenario 4: When NOT to Recommend Agentforce

Situation: A small manufacturing company wants to automate their quote approval process. It follows rigid business rules: orders under $10K are auto-approved, $10K-$50K need manager approval, over $50K need VP approval.

Recommendation: Standard Approval Process + Flow. This is deterministic logic with no ambiguity or natural language component. Agentforce would add unnecessary cost and complexity.

Why not Agentforce? No NLU needed, no customer conversation, purely rule-based. A Flow handles this in hours; Agentforce would take weeks and cost per-conversation/credit fees for zero added value.

Multi-Agent Orchestration

Agentforce supports multi-agent architectures where specialized agents collaborate to solve complex problems.

ConceptHow It Works
Primary AgentSingle point of contact for the user; routes tasks to specialists
Specialist AgentsFocused agents handling specific domains (billing, shipping, returns)
Agent2Agent (A2A)Open protocol for connecting Agentforce to third-party AI agents
Task RoutingAtlas reviews each agent’s description and capabilities to route intelligently
Context SharingConversation context is maintained across agent handoffs

Multi-Agent Complexity

Multi-agent orchestration is powerful but adds architectural complexity. For CTA scenarios, start with a single well-configured agent before recommending multi-agent patterns. The review board will question why you need multiple agents if a single agent with multiple topics would suffice.

Gotchas and Trade-Offs

Critical Gotchas

  1. Data Cloud is strongly recommended — Without it, advanced RAG grounding is severely limited (basic agents can still use CRM queries and Knowledge). Budget for Data Cloud if unified cross-system context is needed.
  2. Credit consumption adds up — At $0.10/action, an agent executing 5 actions per conversation costs $0.50 plus the conversation fee. Model costs carefully.
  3. Hallucination risk remains — Grounding reduces but does not eliminate hallucination. Always include human escalation paths.
  4. Over-automation danger — Not every process needs an AI agent. Deterministic logic in Flows is faster, cheaper, and more predictable.
  5. Testing is non-trivial — AI agents are non-deterministic. The same input may produce different outputs. Testing requires statistical validation, not binary pass/fail.
  6. Pricing model lock-in — Conversations and Flex Credits cannot be combined in one org. Choose carefully based on use case mix.
  7. Agent user permissions — Misconfigured agent user permissions are the leading cause of silent agent failures. Apply least-privilege rigorously.

AI vs Deterministic Automation Trade-Offs

FactorAI Agent (Agentforce)Deterministic (Flow/Apex)
FlexibilityHandles ambiguous inputRequires structured input
PredictabilityNon-deterministic — same input may varyDeterministic — same input, same output
CostPer-conversation/action pricingIncluded in platform licensing
MaintenanceOngoing tuning, topic refinementStandard CI/CD, version control
TestingStatistical validation requiredBinary pass/fail testing
Speed to buildDays for basic agent; weeks for tuningHours for basic Flow; days for complex Apex
ScalabilityScales with conversation volume (and cost)Scales with platform limits (free)
User experienceNatural language, conversationalStructured forms, guided processes

Sources