TL;DR: Salesforce is pushing Agentforce agents to the front of the user experience, which removes visible login and approval checkpoints while leaving access, delegation chains, and audit obligations intact, according to Trust3. The security problem is no longer the screen but the agent boundary and data layer, where purpose-based policy, runtime guardrails, and traceability must replace role-only control.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Trust3's blog post: Salesforce is shifting the user interface to agents, which pushes security control away from the screen and toward the agent boundary and data layer.
Why it matters: IAM, PAM, and NHI teams need to understand that when the interface disappears, approvals, traceability, and purpose scoping must be enforced where agents actually act.
By the numbers:
- Gartner projects that through 2029, more than half of successful attacks on AI agents will exploit access-control weaknesses.
Context
Salesforce Agentforce is being presented as an interface shift, but the security implication is more specific: the control point is moving out of the visible UI and into the agent boundary and data layer. That changes how identity, authorization, and oversight have to be enforced for work executed by non-human actors.
For IAM and NHI programmes, the important question is no longer whether a user can log in and click through a workflow. It is whether an agent can inherit, narrow, and propagate purpose without expanding scope as it traverses tools, services, and data sources.
The article treats this as a control relocation problem, not simply a product update. That makes it relevant to service accounts, delegated access, and AI agent governance at the same time.
Key questions
Q: What breaks when Agentforce agents replace visible login and approval steps?
A: The screen stops being a dependable enforcement point, so identity establishment, authorization, and approval have to move to the agent boundary and the data layer. If governance still assumes a person will see and approve each action, agent-mediated workflows can execute outside the control model without obvious warning.
Q: Why do delegation chains make role-based access control too coarse for agentic workflows?
A: Because the original user intent can be separated from the principal that reaches the data, and static roles do not preserve task scope across hops. Role-based control may still be necessary, but it is not sufficient when agents call tools, hand off work, or traverse service accounts.
Q: How do you know whether an agentic access model is actually under control?
A: Look for live inventory, explicit ownership, task-scoped permissions, identity propagation, and replayable traces. If you cannot show which agents exist, what they can reach, and which originating identity is attached to each decision, the programme is operating with incomplete governance.
Q: What should organisations do when a business workflow starts using autonomous agents?
A: Rework the control model so approval, purpose, and audit evidence attach to the agent’s request path rather than the old human workflow. That includes data-layer enforcement, expiring access, and traceability that survives across tool calls and handoffs.
Technical breakdown
Why the interface layer stops being a reliable control plane
When the interface is the control point, login, menus, and approval prompts can act as checkpoints for identity establishment and authorization. When work is executed by an agent, those checkpoints disappear or become hidden behind runtime delegation. The result is not just a change in user experience but a change in where enforcement has to occur. Controls that depend on a person seeing a prompt or choosing a menu option cannot govern agent-driven execution reliably. Security teams have to assume the UI may no longer be the place where intent, scope, or approval is expressed.
Practical implication: Treat the UI as presentation, not enforcement, and move authorization logic to the point where the agent requests action.
How delegation chains widen access beyond the original user
An agent that calls tools, hands work to another agent, or reaches a downstream data source creates a delegation chain. In that chain, the originating identity can be diluted while the effective scope widens at each hop. That is the core risk in agentic workflows: the principal that began the task may not be the principal that the data layer sees. Purpose-based access control attempts to preserve task intent by binding access to the request rather than the job title, while just-in-time grants and auto-expiring scopes reduce persistence. The hard part is keeping that intent attached across every hop.
Practical implication: Map every handoff in the delegation chain and verify that identity and purpose survive each transition without scope growth.
Why data-layer policy becomes the last enforceable boundary
If an agent can reach records directly, security cannot stop at agent registration or front-door approval. The data source has to know who initiated the action, what purpose was declared, and whether the request still matches that purpose by the time it arrives. Row, column, and tag-based controls are more durable here than role-only permissions because they can enforce at the data source itself. This is especially important when service accounts or intermediate automations would otherwise become the visible principal. Without identity propagation into the data policy, oversight becomes retrospective instead of preventive.
Practical implication: Bind data-layer authorization to the originating identity and purpose, not to the last hop in the chain.
Threat narrative
Attacker objective: The objective is to use agent-mediated access to reach data and execute actions without the control and audit visibility that normally constrain human-driven workflows.
- Entry occurs when an Agentforce agent is created or activated outside a fully governed approval path, allowing capability to exist before oversight catches up.
- Escalation happens as the agent calls tools and hands work across agent or service boundaries, widening effective scope beyond the original user intent.
- Impact follows when the agent reaches business data directly, making access decisions, traces, and audit evidence depend on the wrong principal or no clear principal at all.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Interface collapse is really control-plane collapse: when the UI stops being the place where identity is established and approval is expressed, the governance model behind it is no longer fit for purpose. Security teams should stop treating the screen as the control surface and start treating the agent boundary and data layer as the real enforcement points.
Purpose-based access is the right response to delegation chains, not role-only control: once an agent can move from user intent to tool call to downstream data access, static roles become too coarse to preserve task scope. The article points to a deeper governance shift: access must travel with declared purpose and expire with the task, not the user session.
Identity propagation must reach the data source, or oversight becomes cosmetic: if a service account or intermediary is the only principal visible at the data layer, the original user disappears from accountability. That is a governance failure, not just a logging gap, and it is exactly where NHI and agentic AI controls converge.
Live inventory is now a governance requirement, not an operational nice-to-have: hidden or unapproved agents can accumulate faster than approval workflows can catalogue them. The named concept here is agent boundary visibility, meaning the ability to enumerate which agents exist, what they can reach, and which identities and purposes they inherit. Practitioners need that visibility before they can govern anything else.
Audit evidence has to be identity-propagated, not merely event-based: replay and traceability only satisfy governance obligations when they show who initiated the action, what the agent retrieved, and why the action was allowed. That makes agent observability and data-layer policy part of the same control story, not separate programmes.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agent boundary visibility: agent programmes now need a live register of every active agent, the data it can reach, and the identities it inherits. Without that visibility, approval workflows will always lag the real estate of access.
Control has to follow the task path, not the UI path. That means identity propagation, purpose binding, and data-layer enforcement become the three controls that decide whether agentic workflows remain governable.
The practical shift for security teams is to treat agent observability and data authorization as one operating model. If the agent can act without a durable audit trail, the programme has already lost the ability to explain itself.
For practitioners
- Inventory every Agentforce agent and delegated workflow Establish a live register of agents, owners, reachable data, and inherited permissions so shadow agents do not outpace governance.
- Bind access to declared purpose and task scope Use purpose-based access control with just-in-time grants and auto-expiring scopes so the agent only holds what the current task requires.
- Propagate originating identity through every hop Ensure the user who initiated the task remains visible to downstream policy checks, even when service accounts or intermediate agents are involved.
- Move enforcement to the data source Apply row, column, and tag-based controls where the data lives so authorization does not depend on front-door screens or proxy layers.
- Require replayable traces for agent decisions Keep prompt-to-response traces, tool calls, and retrieval history so auditors can reconstruct who did what and on whose authority.
Key takeaways
- The security issue is not that Salesforce is adding automation. It is that control checkpoints designed for screens and sessions do not govern agent-driven execution well.
- Delegation chains can widen effective access unless identity and purpose are carried through every hop to the data layer.
- Practitioners should anchor governance in live inventory, task-scoped access, and replayable traces so agent actions remain auditable and attributable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents inheriting and widening access across delegation chains. |
| ASI02 — Tool Misuse | Agentforce workflows reach tools and data sources directly, creating tool-use risk. | |
| Recommendation — Bind agent actions to least-privilege identities and block privilege expansion across handoffs. Constrain which tools an agent may invoke and verify each call against declared purpose. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article warns that static roles and service accounts can overstate what an agent should reach. |
| NHI-04 — Insecure Authentication | Identity has to survive the hop from user to agent to data source, or control fails. | |
| Recommendation — Audit agent and service-account privileges against actual task scope and remove excess access. Propagate the originating identity into downstream authorization checks instead of trusting the last hop. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The piece is fundamentally about governance, traceability, and accountability for agentic actions. |
| Recommendation — Establish governance for AI agents that covers ownership, traceability, and accountability. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on how permissions should be scoped and enforced for agent execution. |
| Recommendation — Enforce entitlement checks at the point of agent action and continuously review permissions. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Delegation chains and downstream data access mirror credential abuse and lateral movement patterns. |
| Recommendation — Map agent delegation paths to credential access and lateral movement tactics in detection content. | ||
Key terms
- Agent Boundary: The point where external content, tool outputs, and environment data enter an agent's decision-making path. This is where validation, filtering, and authorization need to happen, because anything admitted at the boundary can shape the agent's next action and expand the attack surface.
- Purpose-Based Access: An access model that allows or denies AI use based on why the request is being made, not only who the requester is. It is more precise than role alone because it can combine identity, data labels, and request context to control sensitive AI interactions at runtime.
- Identity propagation: The preservation of origin and acting principal information as a request moves through multiple services. In MCP chains, this is what allows downstream systems to make a trustworthy authorization decision instead of relying on a stripped-down token with no task context.
- Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 28, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org