Agentforce Data Governance: Coverage, Gaps, and the Context Layer

Emily Winks

Data Governance Expert

Updated:08/04/2026

Published:08/04/2026

21 min read

See Context Agents Live Get the AI Context Stack

Key takeaways

Agentforce's Einstein Trust Layer and Data 360 Policy-Based Governance are real, audited, and SOC 2-scoped
Coverage holds only as far as what Data Cloud has ingested or Zero-Copy-federated, not beyond it
Gartner projects 40% of enterprises will demote or decommission AI agents by 2027 over governance gaps
A context layer extends policy enforcement, lineage, and certified definitions past Agentforce's boundary

What Is Agentforce Data Governance?

Agentforce data governance is Salesforce's built-in control stack for AI agents: the Einstein Trust Layer masks sensitive fields and logs every interaction, Data 360's Policy-Based Governance enforces field and record-level rules, and a permission-inheritance model runs agents under the invoking user's access. This is real, audited governance, scoped to a SOC 2 report covering Agentforce on Hyperforce, but it holds only as far as what Data Cloud has ingested or federated. Data an agent needs outside that boundary needs governance that travels with it, not one that resets at every platform's edge.

Agentforce's governance stack covers

Einstein Trust Layer - masking, zero retention, toxicity detection, and audit logging
Data 360 Policy-Based Governance - field, object, and record-level enforcement across UI, API, and agent access
Permission inheritance - agents act as the invoking user, plus attribute-based rules
SOC 2 scope - "Einstein Platform and Agentforce on Hyperforce"
Coverage boundary - enforced only as far as Data Cloud has ingested or federated

See where governance must extend

Get the Context Layer Ebook

Atlan’s context layer research maps exactly where Agentforce’s own governance authority stops. Agentforce enforces data governance through the Einstein Trust Layer and Data 360’s Policy-Based Governance: masking, permission-set and attribute-based rules, and audit logging scoped to a SOC 2 report covering “Einstein Platform and Agentforce on Hyperforce.” According to Gartner (2026), 40% of enterprises will demote or decommission AI agents by 2027 over governance gaps discovered only after production incidents. That coverage holds only as far as Data Cloud’s ingested or Zero-Copy-federated footprint. Once data lives in Databricks, Snowflake, Microsoft Purview, or Collibra outside that boundary, Atlan’s context layer is what carries policy enforcement and lineage across the systems Agentforce’s own governance doesn’t reach.

Salesforce’s investment here is substantial. The Einstein Trust Layer masks sensitive fields before they reach a model, retains zero data by default, and logs every interaction against a SOC 2 report scoped specifically to Agentforce on Hyperforce. What Salesforce Agentforce is and how it’s architected matters here, since Data 360’s Policy-Based Governance enforces field, object, and record-level rules across the UI, API, and agent access paths, layered with permission-set and attribute-based rules on standard RBAC. Where that coverage runs out, for data an agent needs but Data Cloud hasn’t ingested, is the question this page answers.

Einstein Trust Layer: masking, zero retention, toxicity detection, audit logging
Data 360 Policy-Based Governance: field/object/record-level enforcement, UI to API to agent
Permission inheritance: agents act as the invoking user, plus attribute-based rules
SOC 2 scope: “Einstein Platform and Agentforce on Hyperforce”
Coverage boundary: only as far as Data Cloud has ingested or federated


What it is	Salesforce’s built-in governance stack for Agentforce: Einstein Trust Layer, Data 360 Policy-Based Governance, and permission-set/RBAC plus ABAC enforcement
Key stat	SOC 2 report scoped to “Einstein Platform and Agentforce on Hyperforce”; Gartner projects 40% of enterprises will demote or decommission AI agents by 2027
Best for	Agent workloads that stay fully inside Data Cloud’s ingested or Zero-Copy-federated data footprint
Coverage boundary	Enforcement holds only as far as what Data Cloud has ingested or federated; cross-system permission consistency, non-human identity, and EU AI Act-grade audit trails elsewhere remain open
Core components	Einstein Trust Layer (masking, zero data retention, audit logging), Data 360 Policy-Based Governance, permission-inheritance model, Command Center audit trail
Structural fix beyond the boundary	A context layer carrying policy enforcement, lineage, and certified definitions to every system Agentforce doesn’t reach

What is Agentforce data governance?

Agentforce data governance is the combination of Salesforce controls that decide what an AI agent can see, touch, and log inside the Salesforce ecosystem: the Einstein Trust Layer, Data 360’s Policy-Based Governance, and a permission-inheritance model built on standard RBAC. No independent, vendor-neutral source has untangled these three layers into one clear map; every top-ranking result is either a Salesforce property or a partial consultant take.

The Einstein Trust Layer sits closest to the model. It masks sensitive fields in prompts and outputs, retains zero data by default, screens for toxicity, and logs every interaction, though masking is reportedly switched off in specific Agentforce contexts where it would otherwise break retrieval accuracy (more on that trade-off below). According to Salesforce Help (2026), the architecture is designed so enterprise data never trains third-party foundation models. Data 360’s Policy-Based Governance sits one layer down, at the data platform itself, enforcing field, object, and record-level rules the same way whether an agent, an API call, or a human user is asking.

Einstein Trust Layer

Masking, zero data retention, toxicity detection, and audit logging apply to every Agentforce interaction, not just chat. Salesforce Engineering (2026) describes this as unifying governance once enforced in separate silos across Agentforce, Data 360, MuleSoft, and Informatica, Salesforce’s own acknowledgment that the unification is recent.

Data 360 Policy-Based Governance

Policy rules here are what a compliance team would point to first: what makes an AI governance framework enforceable rather than aspirational, scoped to a real SOC 2 report, not a marketing claim.

This is real, substantial governance investment. It’s not the whole picture; it’s the picture inside one platform’s boundary, and where that boundary sits matters more than whether the investment is genuine.

How does Agentforce enforce permissions for agent actions?

Agentforce agents run with the permissions of the user who invokes them, a permission-inheritance model layered with attribute-based policy rules on top of standard RBAC. According to Salesforce Admins (2025), dynamic data masking and field-exclusion policies apply at the Data Cloud layer before an agent sees a record, a stronger enforcement point than masking only at the prompt. Command Center then captures the resulting actions for audit, the same mechanism EU AI Act traceability will later be measured against.

Permission-set and attribute-based policy rules

RBAC answers “what can this role do.” ABAC layers in “under what conditions”: data classification, time of day, request context. Combined, they land closer to a zero trust data governance posture than a simple allow-list.

Command Center and audit logging

Every agent action logs against that same audited SOC 2 scope, giving compliance teams a real audit surface, not a promised one.

Why data masking is reportedly disabled for Agentforce specifically

The Trust Layer’s masking capability is real, but it’s reportedly turned off in the specific contexts where a masked value would block retrieval-augmented generation accuracy and multi-step planning, since an agent can’t reason over a value it can’t see. Practitioner sources describe this as a deliberate, disclosed trade-off, not a bug. It’s the same tension covered in how to handle PII in AI pipelines: policy must enforce access without destroying the data an agent needs to reason correctly.

Governance layer	What it covers	What it doesn’t reach
Einstein Trust Layer	Prompt and output masking, zero data retention, toxicity detection, audit logging for Agentforce interactions	Data that never enters an Agentforce prompt; enforcement inside the source system itself
Data 360 Policy-Based Governance	Field, object, and record-level policy enforced consistently across UI, API, and agent access	Systems outside Data Cloud’s ingested or Zero-Copy-federated footprint
Permission-inheritance model (RBAC + ABAC)	Agent actions run with the permissions of the invoking user	Autonomous agent actions with no bound human session, the non-human-identity case
Context layer (e.g., Atlan)	Cross-system lineage, ownership, and policy context enforced before any agent queries data, Agentforce included	Nothing Salesforce-native; this is the layer designed to close the gap above

Permission inheritance is sound within Salesforce’s own identity boundary. The open question is what happens once the acting identity is non-human and the resource it needs lives outside that boundary, which is exactly where AI agent identity governance and Agentforce’s own model diverge.

Get the Context Layer Ebook

See why governance that stops at one platform's boundary leaves enterprise AI exposed, and what a cross-system context layer looks like in practice.

Get the Ebook

Agentforce data governance vs. a cross-system context layer: what’s the difference?

Agentforce’s governance and a cross-system context layer aren’t competitors. They operate at different boundaries, and conflating them is exactly what leaves enterprises exposed when data moves between systems.

The clearest evidence that Salesforce itself sees this gap: the 2026 Salesforce-Databricks partnership is framed explicitly around solving the problem that “when data lives across multiple platforms, security rules, identities, and permissions have to be recreated for each system.” That’s a current, unsolved gap being actively worked on, not a gap Salesforce claims is already closed, and not one that doesn’t exist. Zero-Copy federation into Snowflake and BigQuery is real, meaningful progress toward closing it.

A context layer doesn’t replace Agentforce’s runtime governance. It’s the substrate that makes policy and lineage portable to whatever Agentforce, or any other agent runtime, hasn’t ingested yet, the same reasoning behind why AI agents need an enterprise context layer in the first place. An Enterprise Data Graph doesn’t ask which platform an agent happens to be running on before it enforces a policy; that consistency, not raw feature overlap, is the actual difference between the two layers.

Where does Agentforce’s data governance stop?

Agentforce’s governance is enforced consistently only within what Data Cloud has ingested or Zero-Copy-federated. Everything past that boundary is a genuine, currently open gap, not a solved problem and not a fabricated one. According to Gartner (2026), 40% of enterprises will demote or decommission autonomous AI agents by 2027 due to governance gaps discovered only after production incidents. Shiva Varma, Senior Director Analyst at Gartner: “Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure.” Separately, Gartner (2025) projects over 40% of agentic AI projects will be canceled by the end of 2027, citing cost, unclear value, and inadequate risk controls.

According to Cybersecurity Insiders (2026), only 8% of tech leaders report having strong AI governance in place today. That gap isn’t unique to Agentforce, and it isn’t closed by Agentforce’s stack either; it lives at the level of the enterprise’s full agent estate, not one platform’s boundary.

Cross-system permission consistency once data lives outside Data Cloud

Zero-Copy federation moves data access across the boundary. It doesn’t automatically move policy enforcement with it, which is why connecting enterprise data sources to LLMs securely has to be treated as a distinct governance problem.

Non-human identity sprawl and why agent identity isn’t human identity

According to the Cloud Security Alliance (2026), non-human identities now outnumber human identities by an average of 45 to 1, a ratio that climbs to 144 to 1 in cloud-native environments. Agentforce’s permission-inheritance model borrows a human identity for every action; it doesn’t give the agent its own governed identity lifecycle, the exact gap that ratio makes harder to police.

EU AI Act Articles 12 and 26 traceability: what Command Center captures vs. what compliance teams need to prove

The EU AI Act requires high-risk AI systems to support automatic event logging for traceability under Article 12, and separately requires deployers to retain those logs for a minimum of six months under Article 26(6), unless other EU or national law sets a longer period. According to AI2sql (2026), compliance teams increasingly expect that trail to be attributable and tamper-evident by design, not just present. Command Center captures Agentforce’s own actions well; it wasn’t built for a single trail spanning Agentforce, Databricks, Snowflake, and whatever else an enterprise’s agents touch, the gap EU AI Act compliance work has to close. The same boundary applies to the adjacent GDPR and HIPAA obligations enterprises still have to satisfy on their own; Salesforce’s published compliance scope for Agentforce covers SOC 2, and HIPAA coverage depends on a separate, edition-specific Business Associate Agreement enterprises need to confirm directly with Salesforce rather than assume.

Agentforce’s governance is consistently enforced inside Data Cloud’s ingested or federated footprint. Past that line, cross-system permission consistency, non-human identity, and audit-trail traceability are open problems Salesforce is still building toward, not ones it has solved.

This doesn’t mean Agentforce’s governance is weak; it means it’s scoped, and enterprises that treat platform-native governance as if it automatically extends everywhere an agent touches are the ones landing in Gartner’s 40% by 2027. According to Salesforce Ben (2026), 64% of billion-dollar enterprises reported losing more than $1 million to AI agent failures in the past year, evidence the cost of an ungoverned boundary isn’t hypothetical. KeyBanc’s downgrade of Salesforce in July 2026 cited exactly this pattern: customer data not organized for meaningful AI work, and current, not historical, governance maturity gaps.

How to close the governance gap beyond Agentforce’s boundary

Closing the gap starts with mapping exactly what Data Cloud has and hasn’t ingested, then extending policy and lineage to the rest, rather than assuming Agentforce’s governance travels with the data.

Before you start:

Inventory which systems feed Agentforce via Data Cloud ingestion, Zero-Copy federation, or neither
Identify which agents act with human-invoked permissions versus autonomous, non-human-identity permissions
Map current audit-log retention against the EU AI Act’s Article 26(6) six-month minimum

Five steps:

Map the boundary. Confirm exactly which data Agentforce’s governance actually reaches today, not which data it could theoretically reach.
Extend policy context to ingested-but-unfederated systems via a shared context layer, so enforcement doesn’t reset at every platform edge.
Resolve cross-system definition drift, “active account” meaning one thing in Data Cloud and another in the warehouse, before an agent acts on it.
Close the non-human-identity gap with agent-specific identity and permission lifecycle management, not borrowed human RBAC.
Wire audit logs from outside-the-boundary systems into a tamper-evident trail, retained to the EU AI Act’s Article 26(6) six-month minimum, that spans every platform an agent touches.

Three mistakes show up repeatedly once teams start this work:

Assuming Zero-Copy federation means governance is fully unified. It moves data. Verify that policy enforcement, not just data access, travels with it.
Treating masked-data blocking as a bug instead of the disclosed RAG-accuracy trade-off it is. Enforce policy through access and context controls instead of relying on masking alone.
Applying uniform governance across every agent regardless of risk tier. Gartner’s own guidance warns that uniform governance itself causes failure; tier controls by risk instead.

According to Reco.ai (2026), the most common Agentforce security gaps trace back to this exact pattern: teams secure the platform correctly and stop, leaving the rest of the estate ungoverned. Preparing data before agents touch it closes most of this gap before it becomes an incident.

How to choose the right governance layer for agents beyond Agentforce

Selecting what closes the gap comes down to reach, identity handling, audit granularity, and semantic consistency, not whether a tool duplicates Agentforce.

Criterion	Why it matters	What to look for
Cross-system reach	Data lives in Databricks, Snowflake, Microsoft Purview, Collibra, and systems Data Cloud hasn’t ingested	A layer spanning every connector, not only Salesforce-native ones
Non-human identity handling	45 to 144 times more non-human than human identities in large enterprises	Explicit agent-identity lifecycle and permissions, not borrowed human RBAC
Audit-trail granularity	EU AI Act Articles 12 and 26 require auditable, six-month-minimum retained logs with decision traceability	Logs capturing which policy version and definition an agent used, not just that access occurred
Semantic consistency	Cross-system definition drift breaks agent answers even when access is properly governed	A semantic layer resolving business terms before an agent acts
Enforcement point	Masking breaks RAG accuracy; policy has to enforce without breaking retrieval	Row and column-level policy context enforced at query time, not blanket masking

Five questions worth asking any vendor in this category:

Does this cover systems Data Cloud hasn’t ingested or federated?
How does it handle non-human identity lifecycle, distinct from human RBAC?
Can it produce EU AI Act-grade audit trails, Article 12 logging plus Article 26 retention, spanning multiple platforms?
How does it enforce policy without relying on masking that breaks RAG accuracy?
Does it resolve business-term definitions consistently across every system an agent touches?

Teams evaluating this space are usually also weighing how to secure multi-agent systems and broader AI agent risks and guardrails; this is one part of that larger evaluation, not a separate purchase.

Check your agent context readiness

See how your organization's agent governance stacks up against the identity, audit, and cross-system gaps enterprises hit once data moves beyond a single platform.

Take the Checklist

How Atlan approaches governance beyond the Agentforce boundary

The investment behind Agentforce’s governance is real and improving fast, but its reach is scoped to what Data Cloud has ingested or federated. Enterprises whose agents, Agentforce included, need to reason over data across Databricks, Snowflake, Microsoft Purview, and Collibra hit a governance seam: permissions, definitions, and audit trails don’t travel with the data once it crosses that boundary. That seam is also where AI agent accuracy problems start, since an agent reasoning over ungoverned data is guessing, not answering.

Atlan’s Enterprise Data Graph gives cross-system lineage and ownership spanning every connector, not just Salesforce-native ones. Policy context enforces access rules at the point an agent queries data, before it reaches the model, as row and column-level policy context rather than IAM alone. Active Ontology resolves what a business term means, “customer,” “active account,” before an agent acts on it, closing the cross-system definition gap Agentforce’s CRM-scoped governance can’t reach alone. A native Atlan MCP server gives Agentforce, or any agent runtime, an external source of governed context Data Cloud alone doesn’t hold, the pattern Salesforce’s own Data 360 MCP Server points toward for its own ecosystem.

Atlan is a Leader in the 2026 Gartner Magic Quadrant for D&A Governance Platforms and the Forrester Wave for Data Governance, Q3 2025, analyst recognition distinct from any category label. General Motors, Workday, Mastercard, Nasdaq, and Virgin Media O2 use Atlan for governed AI context generally; none is a confirmed Agentforce-specific pairing. They’re cited as evidence of Atlan’s track record extending governed context across a full data estate, at the scale scaling AI agents from POC to production requires, not as an Agentforce case study.

Real stories from real customers: context governance beyond the CRM boundary

"We're excited to build the future of AI governance with Atlan. All of the work that we did to get to a shared language at Workday can be leveraged by AI via Atlan's MCP server…as part of Atlan's AI Labs, we're co-building the semantic layer that AI needs with new constructs, like context products."

— Joe DosSantos, VP of Enterprise Data & Analytics, Workday

Watch Now →

"Atlan is much more than a catalog of catalogs. It's more of a context operating system…Atlan enabled us to easily activate metadata for everything from discovery in the marketplace to AI governance to data quality to an MCP server delivering context to AI models."

— Sridher Arumugham, Chief Data & Analytics Officer, DigiKey

Watch Now →

See Atlan in action

Watch how the context layer enforces policy, lineage, and certified definitions across every system an agent touches, Agentforce included.

Watch the Demo

Where Agentforce’s governance ends is where the real work starts

Salesforce’s investment in this stack is substantial and genuinely improving. The Einstein Trust Layer, Data 360 Policy-Based Governance, permission inheritance backed by RBAC and ABAC, and a real SOC 2 report are not marketing claims; they’re audited, documented, and getting better every quarter, including through the new Databricks partnership and Zero-Copy federation.

None of that changes where the boundary sits. Enforcement is consistent inside what Data Cloud has ingested or federated. Past that line, permissions, definitions, and audit trails don’t travel automatically, and that’s a currently open gap for every enterprise running agents across more than one platform, not a flaw specific to Agentforce. The multi-cloud context layer question, and the data sovereignty questions that come with it, are exactly what enterprises still have to answer themselves once an agent’s reasoning crosses that line.

The teams that get ahead of Gartner’s 40% figure are the ones treating the boundary as a known, mapped fact rather than an assumption. Context engineering is what makes that boundary explicit instead of discovered after an incident, and making AI agents genuinely context-aware depends on closing it deliberately, not on hoping Data Cloud’s ingestion eventually catches up to every system an agent needs.

Book a Demo

FAQs about Agentforce data governance

1. What is Agentforce data governance?

Agentforce data governance is the set of Salesforce controls that decide what an AI agent can access, act on, and log: the Einstein Trust Layer (masking, zero data retention, toxicity detection, audit logging), Data 360’s Policy-Based Governance (field, object, and record-level enforcement), and a permission-inheritance model layered with attribute-based rules on top of standard RBAC.

2. Does Agentforce access data outside Salesforce?

Yes, through Data Cloud ingestion and Zero-Copy federation into platforms like Snowflake and Databricks. Governance enforcement is consistent only as far as that ingested or federated footprint reaches; data an agent needs that Data Cloud hasn’t touched sits outside Agentforce’s own governance model.

3. What is the Einstein Trust Layer?

The Einstein Trust Layer is Salesforce’s governance layer sitting closest to the model. It masks sensitive fields in prompts and outputs, retains zero data by default, screens for toxicity, and logs every agent interaction for audit.

4. Is Agentforce SOC 2 or HIPAA compliant?

Salesforce maintains a SOC 2 report covering the Einstein Platform and Agentforce on Hyperforce specifically, not a general-purpose Salesforce certification. HIPAA works differently: it depends on a signed Business Associate Agreement scoped to the specific Salesforce edition and product in use, which enterprises need to confirm directly with Salesforce for their Agentforce deployment rather than assume from the SOC 2 scope. Either way, neither certification automatically extends compliance obligations to data an agent reaches outside Salesforce.

5. Does data masking work with Agentforce?

Masking is reportedly disabled in specific Agentforce contexts because masked values break retrieval-augmented generation accuracy and multi-step planning. This is a disclosed trade-off, not a defect: Salesforce enforces policy through other controls, like Data 360’s field-level rules, rather than relying on masking alone in those cases.

6. How does Agentforce log or audit agent actions?

Command Center captures agent actions for audit, feeding into the SOC 2 report scoped to Agentforce on Hyperforce. This gives compliance teams a real, usable audit surface within Salesforce’s own boundary.

7. Does Agentforce comply with the EU AI Act?

Agentforce’s Command Center captures its own actions, but the EU AI Act’s logging requirement (Article 12) and its six-month minimum retention obligation (Article 26(6)) apply to an enterprise’s full AI agent estate, often spanning more than one platform. Enterprises running agents across Agentforce and other systems need a trail that covers all of them, which Command Center alone was not built to provide.

8. What governance gaps do enterprises hit with Agentforce?

The three recurring gaps are cross-system permission consistency once data lives outside Data Cloud’s footprint, non-human identity management (agents borrow human permissions rather than having their own governed identity lifecycle), and EU AI Act-grade audit trails spanning multiple platforms. All three are addressed by extending a governed context layer past Agentforce’s own boundary, not by anything Agentforce’s native controls cover today.

Sources

Share this article

Atlan is the next-generation platform for data and AI governance. It is a control plane that stitches together a business's disparate data infrastructure, cataloging and enriching data with business context and security.

Book a Demo Context Studio Live