Agentforce multi-agent solutions support user-level authentication. Authentication varies by agent type and by the combination of orchestrator agent and connected subagent.
Required Editions
| Available in: Lightning Experience |
| Available in: Enterprise, Performance, Unlimited, and Developer Editions. Required add-on licenses vary by agent type. |
Authentication for Agent Type Combinations
| Orchestrator Agent | Connected Subagent | Authentication |
|---|---|---|
| ASA | ASA |
For ASA, a connected subagent runs as the orchestrator agent's session user (the digital user), not as its own agent user. After a customer logs in to the ASA orchestrator, the platform passes that identity through the authenticated session. You can't change the connected subagent's running user with an access element, a variable, or a linked variable. Unauthenticated guest users are also supported. |
| AEA | AEA | AEA connected subagents run in the logged-in user's context. The user must be logged in beforehand. Variables such as currentUserId aren't available in this context, which is by design for security reasons. |
| AEA | ASA | An ASA connected subagent runs as its own agent user, not in the logged-in user's context. Configure the ASA agent user with the permissions required to perform its actions. |
For AEA, assign the logged-in user the permissions required for any operation the connected subagent requests.
An ASA orchestrator with AEA connected subagents isn't supported in this release.
For additional information, see: