---
schema_version: "1"
id: bcdb9bb2bf20c4dc356b42a1db4623340b171d8a893e3b6815b0f5a878ba9e5e
title: User-Level Authentication in Multi-Agent Solutions
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/agent_multi_orch_auth.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.agent_multi_orch_auth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4a2b2abfb7fe64992212446dd4cf2b2a0c8e146f4b49be1255eabe3f61fab814
description: Agentforce multi-agent solutions support user-level authentication. Authentication varies by agent type and by the combination of orchestrator agent and connected subagent.
products:
  - Agentforce
  - Cross Cloud
release: "264"
---
# User-Level Authentication in Multi-Agent Solutions

Agentforce multi-agent solutions support user-level authentication. Authentication varies by agent type and by the combination of orchestrator agent and connected subagent.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions. <a href="https://help.salesforce.com/s/articleView?id=ai.agent_setup_explore_types.htm&amp;release=264.0.0&amp;type=5" title="Learn about agent types and default templates for specific clouds and common use cases.">Required add-on licenses vary by agent type.</a></td></tr></tbody></table>

## Authentication for Agent Type Combinations

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:20%">
          <col style="width:20%">
          <col style="width:60%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" id="d160699e83" style="vertical-align:top;">Orchestrator Agent</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d160699e86">Connected Subagent</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d160699e89">Authentication</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <th scope="col" class="slds-cell-wrap" id="d160699e98" style="vertical-align:top;" headers="d160699e83 ">ASA</th>

            <td data-label="Connected Subagent" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e98 d160699e86 ">ASA</td>

            <td data-label="Authentication" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e98 d160699e89 ">
              <p>For ASA, a connected subagent runs as the orchestrator agent's session user (the
                digital user), not as its own agent user. After a customer logs in to the ASA
                orchestrator, the platform passes that identity through the authenticated session.
                You can't change the connected subagent's running user with an access element, a
                variable, or a linked variable.</p>
              <p style="margin-bottom:0;">Unauthenticated guest users are also supported.</p>
            </td>

          </tr>
          <tr class="">
            <th scope="col" class="slds-cell-wrap" id="d160699e116" style="vertical-align:top;" headers="d160699e83 ">AEA</th>

            <td data-label="Connected Subagent" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e116 d160699e86 ">AEA</td>

            <td data-label="Authentication" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e116 d160699e89 ">AEA connected subagents run in the logged-in user's context. The user must be
              logged in beforehand. Variables such as currentUserId aren't available in this
              context, which is by design for security reasons.</td>

          </tr>
          <tr class="">
            <th scope="col" class="slds-cell-wrap" id="d160699e128" style="vertical-align:top;" headers="d160699e83 ">AEA</th>

            <td data-label="Connected Subagent" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e128 d160699e86 ">ASA</td>

            <td data-label="Authentication" class="slds-cell-wrap" style="vertical-align:top;" headers="d160699e128 d160699e89 ">An ASA connected subagent runs as its own agent user, not in the logged-in
              user's context. Configure the ASA agent user with the permissions required to
              perform its actions.</td>

          </tr>
        </tbody>
      </table>

For AEA, assign the logged-in user the permissions required for any operation the connected subagent requests.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ai-generative_ai-264-0-0-production-enus/f8ef6498-d7b2-44e3-9b34-ffd5a850aae9/images/icon_note.png)

Note

An ASA orchestrator with AEA connected subagents isn't supported in this release.

For additional information, see:

- [Configure Service Agent Access](https://help.salesforce.com/s/articleView?id=ai.agent_user.htm&release=264.0.0&type=5 "Learn how Agentforce Service agents control data access. Set up an agent user for your Agentforce Service agent and assign permissions, so your agent has everything it needs to do its job.")
- [Manage Employee Agent Access](https://help.salesforce.com/s/articleView?id=ai.agent_manage_aea_access.htm&release=264.0.0&type=5 "Control user access to specific Agentforce Employee agents with permission sets or profiles. In Agentforce Builder, use the Agent Access page. In the legacy Agentforce Builder, use the Agent Access tab.")