Agentforce Governance Checklist
Agentforce is on by default in Winter '27. Agents inherit whatever access their user already has, making permission debt an AI risk. Run this audit before it goes live.
The Quick Answer
Agentforce agents run with the permissions of their assigned user. If that user has Modify All Data, so does the agent. Winter '27 enables Agentforce by default in eligible orgs and retires the Setup off switch. Before that happens, audit every permission set, check guest user profiles, inventory agent identities, enable MCP Risk Scores, and build a review queue for agent-proposed changes.
The Checklist
- Run the permission set audit Export all permission sets and review object, field and Apex class access. Flag any set with Modify All Data or View All Data. These are the biggest risks when agents inherit them.
- Check guest user profiles List every Site and Community guest user. Confirm each has explicit read-only access, no Modify All. Agents serving external users inherit these profiles.
- Inventory every agent identity Find every connected app, external client app and MCP server. Classify each as agentic (AI chooses calls at runtime) or traditional (human designed the sequence). Get agents off personal logins.
- Turn on MCP Risk Scores In Security Center, enable MCP Risk Scores. Winter '27 rates every third-party MCP server Low, Medium or High. Block any High-risk server before adding more skills.
- Build the review queue Create a queue and assignment rule for agent-proposed changes. Name an owner per business domain. Casey and other self-optimizing agents propose changes that need human approval.
- Set spend alerts Configure Flex Credit alerts and monthly reporting. Assign an owner for each agent's consumption. Agentic Identity will meter external agent calls as Headless Platform Interactions.
Frequently Asked Questions
What is Agentforce?
Agentforce is Salesforce's AI agent platform, enabled by default in Winter '27 for eligible orgs. Agents can automate tasks, propose changes, and interact with records. They inherit whatever access their assigned user already has, making permission audits critical.
When does Agentforce turn on by default?
Winter '27 turns Agentforce on in eligible orgs and is retiring the Setup off switch. Most production orgs will be affected by late 2026. Check the release update in Setup to see if your org is included.
What are MCP Risk Scores?
MCP Risk Scores are a Winter '27 Security Center feature that rates third-party MCP (Model Context Protocol) servers as Low, Medium, or High risk. Admins can block dangerous servers before they connect to agents.
How do I audit Agentforce permissions?
Export all permission sets, review object and field access, flag any with Modify All Data, check guest user profiles, and confirm every agent has minimal required access. Pay special attention to permission sets assigned to integration users.
What is a self-optimizing agent?
Agents like Casey can now propose their own improvements, such as new automation rules or response templates. A human must approve each change. Build a review queue with clear owners before enabling these features.
Sources & Related Posts
- Agentforce is on by default now. Here's the permission audit I'd run this week
- Winter '27's MCP Risk Scores are the security feature I'd turn on first
- Casey can now improve itself. Your team still has to approve every change
- Salesforce Agentic Identity is targeting November. Inventory every agent before the meter starts
- Salesforce Help: Guest User Security
This guide is maintained by Devarshi Mishra and updated as Salesforce releases new information.