22 October 2026 · Devarshi Mishra

Salesforce Agentic Identity is targeting November. Inventory every agent before the meter starts

Salesforce plans to give external AI agents their own registered identity and to bill each successful MCP or API call they make as a Headless Platform Interaction in Flex Credits. The rate is still TBA and Salesforce is now talking to partners about the pushback, so use the time to find and classify every agent that touches your org.

• Salesforce
• AIforce
• Agentic Identity
• MCP
• Flex Credits
• Integration

Most of the orgs I work on already have AI agents talking to them. Someone connected Claude through an MCP server. A vendor added an "AI assistant" to a managed package. A developer wired an LLM into a script that runs under the integration user. Very few teams could hand me a list of these today.

That list is about to matter. Salesforce plans to make every external agent register for its own identity, and to bill the calls those agents make. The price is not set yet, and Salesforce is now talking to partners about the backlash. I would not wait for that conversation to finish before doing the inventory.

What Salesforce has said

The detail is in a Salesforce Help article, Understand AIforce Impact, published on 17 September. It says AIforce, first announced at TDX 2026 as "Headless 360", comes with new security controls, agent registration and a new billing model as part of the Headless Toolkit, all targeting November.

Registration gives each agent "a discrete identity" instead of letting it run under the identity of the person it assists. Admins can give that identity a narrower permission set than a human user. Salesforce's own phrase is "issuing the agent its own badge, rather than lending it an employee badge."

Billing follows from the same step. Once an agent is registered, every successful call it makes to Salesforce, over MCP or a direct API, is metered as a Headless Platform Interaction (HPI), tracked in Digital Wallet and paid in Flex Credits.

A few limits are worth knowing:

• The multiplier for HPIs is listed as "TBA", agentic usage is not metered yet, and Salesforce will give 30 days' notice before it starts.
• Only active production orgs are metered. Sandboxes, scratch orgs and Developer Edition orgs are not.
• Traditional integrations keep their current pricing and security options.
• Your org needs Flex Credit billing enabled, for example through Salesforce Foundations, which the article says is currently available at $0.

The deadlines depend on how the agent connects. Any use of a Salesforce MCP server needs agent registration within three months of Salesforce's notice that Agentic Identity is available, for all customers. Existing customers with API-based agents register and migrate at renewal. Customers buying on or after 17 September register API-based agents within three months of the notice.

Why partners pushed back

Salesforce Ben reported on 21 October that Salesforce has opened direct talks with partners after the reaction. Amnon Kruvi, an architect who runs both an ISV and an SI, had called the change a "death knell" on LinkedIn. He told SF Ben that senior Salesforce people then called him to discuss it.

His three asks were more predictable pricing for agents, new value from the platform to justify agent pricing beyond plain MCP access, and a way for customers and partners to keep using AI to configure and support orgs. On that last point he noted that "a lot of the setup that people do still happens in production." His summary of the talks: "We did not get to resolving everything just yet, [but] I will say that we are on the right path."

So the model may change. But the registration requirement is the part I expect to stay, and the security case for it is strong.

Why I'd start with the inventory

A Salesforce spokesperson told SF Ben in September that the cost per interaction does not vary, but the number of interactions depends on the third-party agent's behaviour and on how it is implemented, including the harness and prompt. In plain English, a chatty agent costs more than a careful one, and you won't know which kind you have until you look.

SF Ben's Tim Combridge put the planning problem well: organisations "will need to know what they're looking to achieve with their agents, and estimate the cost of running them before they can make a decision on whether or not to proceed."

The hard part is classification. Vantage Point's guide offers a test I like because it is simple: who decides the next call, and whose credentials does it present? If an AI model picks the calls at runtime, treat the connection as agentic. If a person designed the sequence in advance, it is a traditional integration. Middleware is the grey zone. If Claude calls a MuleSoft API that writes to Salesforce, the call comes from the middleware but the decision came from an agent, and Salesforce hasn't said how it will treat that.

Don't use this as a reason to hide agents behind an integration user. That leaves you with no audit trail of which agent did what, and Vantage Point rightly flags it as contract risk too.

What I would do before November

1. List every connection into production. Connected apps, External Client Apps, MCP servers and personal OAuth grants to AI tools. Login history helps here.
2. Classify each one. Agentic, traditional or grey zone, with one line on why. Ask who picks the calls and whose login it uses.
3. Get agents off personal logins. An agent using someone's session is exactly what registration is meant to end. Find these first.
4. Split shared credentials. One integration user per integration, one identity per agent, so you can audit or revoke one without breaking another.
5. Baseline call volumes. Measure calls per workflow for agentic and grey-zone connections now, so you can price them once the rate is published.
6. Check your dates. Note your renewal date, whether you use a Salesforce MCP server, and whether Flex Credit billing is enabled.
7. Ask vendors in writing. For each ISV: does any feature let AI choose Salesforce calls, and when will it support Agentic Identity?

The takeaway for CRM and RevOps teams

The price per call is not the decision you can make today. Salesforce hasn't set it, and partners are still negotiating. The decision you can make is to know exactly which agents touch your org, what they are allowed to do and how often they call. That inventory gives you better security whatever happens, and when the rate card arrives, it turns a guess into a budget line.