Enforcing identity, data and API governance on an agent platform
Governance goes siloed fast once a company starts shipping AI agents. Identity, data access and API security each get enforced on their own, and the gaps between them open up as soon as an agent starts working across systems. Salesforce Engineering moved the problem down to the platform layer instead, wiring Agentforce, Data 360, MuleSoft, Informatica and the core platform together so every interaction goes through the same controls. Three problems fall out of that work, and the platform answers each one.
Propagating identity and authorization across multi-system agent workflows
A complex agent workflow fans out into downstream API calls, inter-platform service invocations and coordinated agent actions. Without consistent identity propagation, attributing, governing and auditing any of it gets hard.
The core Salesforce platform carries identity through the whole execution chain. A user-driven agent propagates the identity of the user who invoked it; an autonomous agent runs on its own system identity. Every action therefore has a consistent identity context however tangled the workflow gets, and the platform can tell an agent acting on its own apart from one acting as a proxy for a person. That distinction matters more as agent-driven workflows reach further into the business.
Authorization sits on top of that identity model and follows the principle of least privilege. Tokens are scoped to the minimum permissions required. The platform also governs which agent actions are discoverable and usable at all, in line with the same authorization policies. Because both the user and the agent identity travel with the request, access policies apply at a fine grain.
Identity propagated this way is durable and reliable enough to use as an authorization attribute on every interaction in a distributed workflow.
Centralized enforcement, so nothing routes around it
Agentic workflows widen data access and connectivity, which strains governance models that were not built for it. Data moves through APIs, unstructured search, external connectors and multi-step orchestrations, and each is a chance to slip past a control.
Data 360 and the core Salesforce platform route every data access through one enforcement layer. It sits between the access patterns and the underlying systems and applies policy uniformly: role-based and attribute-based policies, object, field and row-level security, dynamic masking.
Agentforce agents reach unified enterprise data through Data 360, real-time and zero-copy sources included, with platform-managed governance applied on the way. The controls cover structured and unstructured data, and sensitive information gets detected and tagged during ingestion so the same rules apply at retrieval, which lowers the odds of restricted content turning up in an agent response. Zero-copy access to external systems stays governed through the same mechanisms.
The design principle underneath is independence from agent behavior. An agent only ever retrieves data the access model already permits, however the request was constructed and whichever systems it touched.
Unifying governance across data, APIs and AI models
Isolated governance layers stop working once agents interact across systems, APIs and AI models. Identity, data and API controls have to hold as a workflow crosses platform boundaries into external services.
MuleSoft supplies a single policy enforcement layer across APIs, integrations and external systems, evaluating API traffic against policies like authentication, authorization and rate limiting at configured points.
Informatica works the other side, discovering and classifying data automatically across the enterprise architecture. Mapping lineage and pulling semantic context out of external systems such as ERPs and third-party data warehouses closes the governance blind spots, so agents stay inside data handling policies and respect sensitive data boundaries.
Enterprise AI adoption has been fast enough to leave model access and governance fragmented, with no cost controls, no audit trails and no consistent policy enforcement for LLM interactions. MuleSoft's AI Gateway answers that with a unified access layer across multiple LLM providers, carrying governance, intelligent routing and cost management for AI applications.
Real-time enforcement is only half of it. Trace data from agentic interactions aggregates in Data 360 as a unified observability layer covering Salesforce and external systems, which is what lets you reconstruct agent behavior end to end, audit data access, and spot unexpected patterns or anomalies.
AI model interactions carry risks of their own, data persistence and sensitive information sharing among them, which need controls that did not exist before. The Agentforce Trust Layer handles those by grounding responses in enterprise data, masking sensitive information and stopping external model providers from retaining customer data.
The layers work together. Every request is evaluated against identity, data governance, API policy and AI trust, and anything failing one of those constraints is blocked or restricted.
Where this goes next
AI agents make enterprise systems more capable and widen the risk surface at the same time. Securing them means embedding governance into every decision and execution layer, because controls at the edge do not reach far enough on their own.
Putting identity, data access, API interactions and AI behavior into one cohesive system is what keeps governance holding as agents operate in distributed environments. Agentforce goes on enforcing trust, governance and interoperability on that foundation, and the design assumes it has to keep adapting alongside the systems it protects.
Leave a Comment