--- schema_version: "1" id: d31f5ddc7ce00f9de4aa92731abab84d5b3906b605de5075897e92d38ba6c46e title: Trust and Agentforce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/copilot_trust.md canonical_url: https://help.salesforce.com/s/articleView?id=ai.copilot_trust.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 54e3b3db51c14fc1030be3a52b9f0fd4bbf1c12486eddcebb64674707e728c0b description: With Salesforce, it’s easy to build safe AI agents because agents are designed to help mitigate the risks associated with generative AI technology. products: - Agentforce - Cross Cloud release: "264" --- # Trust and Agentforce With Salesforce, it’s easy to build safe AI agents because agents are designed to help mitigate the risks associated with generative AI technology. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, Unlimited, and Developer Editions. Required add-on licenses vary by agent type.
The Agentforce platform is integrated with the Einstein Trust Layer, and the feature includes AI guardrails. Agents also respect standard Salesforce access controls. ## Einstein Trust Layer Agentforce is integrated with the Einstein Trust Layer, which is a secure AI architecture natively built into Salesforce. Designed for enterprise security standards, the Trust Layer lets you benefit from generative AI without compromising your customer data. It also lets you use trusted data to improve generative AI responses. | Einstein Trust Layer service | Description | | --- | --- | | Zero Data Retention Policy | Einstein Trust Layer uses a zero-data retention policy, so no data is stored or used for model training by third-party LLMs. Customers’ use of other features including agents may result in data storage. For more information, contact your Salesforce account executive. | | Dynamic Grounding with Secure Data Retrieval | Relevant information from trusted company data, your knowledge base, or other sources you configure, is used to answer a question. | | Prompt Defense (System policies and prompt injection detection) | System policies help limit hallucinations and decrease the likelihood of unintended or harmful outputs by the LLM. | | Toxicity Detection | Potentially harmful LLM responses are detected and flagged. | | Audit and Feedback | Prompts, responses, and trust signals are logged and stored in Data 360, giving you visibility into the results of each user interaction. Feedback can be used for improving instructions, prompt templates, and more. | Data masking through the Einstein Trust Layer is disabled to improve the performance and accuracy of agents. All data accessed by agents, including personally identifiable information (PII), is protected in transit and isn't stored or used for training purposes by external LLM providers, as part of our strict zero-data retention policy. See [Data Masking Limitations in Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_trust_data_masking.htm&release=264.0.0&type=5 "In Einstein Trust Layer, pattern-based and field-based data masking for large language models (LLMs) is disabled for agents."). ## AI Guardrails The Agentforce platform includes ethical guardrails to minimize AI hallucinations and security guardrails to prevent threats and malicious attacks, such as prompt injections. For more granular control, use agent subagent instructions to create boundaries, set context, and define agent behavior. You can modify the instructions for a standard agent subagent, or you can create a custom subagent from scratch. Use [instruction adherence](https://help.salesforce.com/s/articleView?id=ai.agent_guardrails_instruction_adherence.htm&release=264.0.0&type=5 "Instruction adherence is an agent guardrail that evaluates how well your agents interpret subagent instructions when generating responses.") to see how well the agent is interpreting and following the subagent instructions. Different agent types can have their own settings and guardrails to define agent behavior. For example, Agentforce Service agent templates use subagent instructions to determine when to escalate a conversation from the agent to a service rep. The SDR agent type has admin-defined engagement rules for the conditions when the agent can start working on the lead and how and when agent emails can be sent. ## Permissions and Access AI agents respect standard Salesforce access controls such as licenses, permissions, field-level security, and sharing settings, so an agent always acts securely. - Agent types: The default Agentforce agent is available to admins and users with the Agentforce Default permission sets. Some agent types are built to work with specific clouds or licenses, so they require another license. - Standard Agent Subagents: Many standard subagents are available to all users who have permission to access the default Agentforce agent. - Standard Agent Actions: Many standard actions are available to all users who have permission to access the default Agentforce agent. Some standard actions are built to work with specific clouds or products, so they require another license or permission. - Custom Agent Actions: Access to a custom action depends on the Apex class, flow, or prompt template the action references. For example, if a custom action is built using a flow, the custom action adheres to the permissions, field-level security, and sharing settings configured in the flow. ## Trusted URLs Agentforce enforces your business’s trusted URL allowlist. This prevents your agent from calling or generating any malicious links and keeps your sensitive data secure. When an agent attempts to include an unapproved URL in a response, the unapproved URL is replaced with “URL\_Redacted.” We also show an error message in the plan canvas when the agent attempts to call or generate an unapproved URL, so you can evaluate whether a blocked URL should be allowlisted or removed from your agent’s configuration. When [citations](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_citations.htm&release=264.0.0&type=5 "Citations link AI-generated responses to the grounding sources that are relevant to the response. Use citations to see what information the large language model (LLM) used to generate the response, and to verify the validity of the source data. Citations help you identify potential inaccuracies or hallucinations in the generated responses, increasing your confidence in using AI tools.") are configured for your agent, source URLs used to generate agent responses are shown in the agent conversation, even if the domain isn't included in your trusted URLs. To use a URL with an agent, [add it to your trusted URLs](https://help.salesforce.com/s/articleView?id=xcloud.security_trusted_urls_manage.htm&type=5&language=en_US). ## Agent Compliance Agentforce is included as a Covered Service in the Einstein Platform and Agentforce SOC 2 and SOC 3 reports. Agentforce is HIPAA eligible and covered under the Salesforce [Business Associate Addendum Restrictions](https://www.salesforce.com/company/legal/business-associate-addendum-restrictions/), and has also achieved ISO 27001, 27017, and 27018 certifications. - **[Data Masking Limitations in Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_trust_data_masking.htm&release=264.0.0&type=5)** In Einstein Trust Layer, pattern-based and field-based data masking for large language models (LLMs) is disabled for agents. #### See Also - [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_layer.htm&release=264.0.0&type=5 "Trusting generative AI with your company secrets and your customer data while balancing the benefits of generative AI is still a challenge today. The Einstein Trust Layer is a secure AI architecture, built into the Salesforce platform. It’s a set of agreements, security technology, and data and privacy controls used to keep your company safe while you explore generative AI solutions.") - [Subagents in the Legacy Builder](https://help.salesforce.com/s/articleView?id=ai.copilot_topics.htm&release=264.0.0&type=5 "A subagent is a particular job an agent can do and an essential element of an agent’s reasoning. A subagent contains actions, which are the tools available for the job, and instructions, which tell the agent how to make decisions. Collectively, the subagents assigned to your agent define the capabilities your agent can handle. Salesforce provides a library of standard subagents for common use cases, and you can create custom subagents to meet your users’ specific business needs.") - [Best Practices for Subagent Instructions in the Legacy Builder](https://help.salesforce.com/s/articleView?id=ai.copilot_topics_instructions.htm&release=264.0.0&type=5 "Subagent instructions set guidelines for agent behavior and give an agent the context it needs to do its job. Review best practices for writing subagent instructions to reduce latency and help your agent respond accurately and consistently.")