Agentforce actions need a declared reasoning-and-permission path

Classify every action by selection and consequence

The direct answer is to record two separate decisions for every Agentforce action: how the reasoning path makes it available and what enterprise consequence it can create. A tool listed for model selection has a different failure path from a deterministic control enforced by the referenced business system. The architecture record should name the invoking agent or subagent, action version, referenced implementation, input contract, authoritative data, user or service identity, permitted objects and fields, expected output, customer-display rule, write or external-call consequence, confirmation requirement, and recovery owner. Describing all of that simply as an agent action hides the control choices that matter most.

Keep orchestration separate from authorization

A reasoning engine's decision to call a tool is not authorization for the underlying transaction. Permission must remain enforceable in the referenced Flow, Apex class, API, and system of record, under the identity that actually executes the work. The CIO should require least privilege, field and record restrictions, separation of duties, rate and value limits, idempotency, customer and employee boundaries, and a deterministic block for actions that need approval. Negative tests should include malformed and adversarial inputs, an entitled user crossing into a restricted record, an unentitled user eliciting a tool call, repeated calls, stale session context, a changed action description, and a valid recommendation that still exceeds transaction authority.

Test model choice as a release artifact

Where the model may choose an action, evaluation needs to cover both inappropriate execution and inappropriate non-execution. The test set should include ambiguous requests, conflicting instructions, missing prerequisites, tool-name and description changes, near-duplicate tools, unavailable dependencies, unsafe output-display choices, and cases where the correct response is to ask, transfer, or stop. Preserve the model and agent versions, instructions, action definitions, tool descriptions, permissions, test inputs, selected and rejected tools, outputs, side effects, and reviewer disposition. A successful demo proves one path worked once; it does not establish stable selection across model, prompt, schema, permission, or dependency changes.

Design rollback around state, not only code

Rolling back an agent definition cannot undo an email, field update, case closure, entitlement change, order, or external API call already completed. Each action therefore needs a state-aware recovery plan: detect partial execution, identify every affected system, suppress duplicate retries, reverse only when the business system permits it, preserve the original event, and route irreversibility to a named service owner. Release gates should compare deterministic and model-chosen paths under the same representative workload and require observability from request through downstream commit. The CIO can approve broader action scope only when selection, authorization, evidence, and recovery remain clear after a failure—not merely when the agent produces the intended answer.

Turn this source into a reviewable decision

For AI for CIOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve Agent Script Blocks | Agentforce Developer Guide, the exact URL, the August 24, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Identity and agent access; Service management and employee support; Enterprise AI platform architecture; Operations and incident intelligence. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

Salesforce is the provider source. Its current Agentforce Developer Guide describes agents running in a user's permission context, subagent instructions and logic, actions defined for a subagent, and reasoning.actions used to expose tools to the reasoning engine. It does not independently establish a buyer's product edition, configured agent, action implementation, identity, permissions, input validation, model behavior, selection reliability, logging, downstream transaction controls, idempotency, recovery, service reliability, cost, or business outcome. Current contracts and release notes, architecture and action inventories, agent and implementation versions, configured identities and permissions, representative reasoning and deterministic-control tests, downstream state and recovery evidence, and qualified architecture, application, data, security, privacy, service, business, procurement, and legal review control.