--- schema_version: "1" id: 895af77bd8431cf37be0f3bf6c33aaa6735a44bec8cabdd1e3f72acbdad838bc title: Add User Identification to Agentforce Actions collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/service_agent_secure_actions_implement.md canonical_url: https://help.salesforce.com/s/articleView?id=ai.service_agent_secure_actions_implement.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 8f4225eb4f82a8a90d00ed591f5d4c2d9ebd80f280c67a9d1a8bdb5690ecf30e description: When configuring your agent that connects to customer channels so that it can take private actions securely, have it confirm the identity of the person it’s interacting with according to your company’s standards. products: - Agentforce - Cross Cloud release: "264" --- # Add User Identification to Agentforce Actions When configuring your agent that connects to customer channels so that it can take private actions securely, have it confirm the identity of the person it’s interacting with according to your company’s standards. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, Unlimited, and Developer Editions. Required add-on licenses vary by agent type.
Agentforce Service agents can be deployed in multiple Messaging configurations: - An Enhanced Chat channel deployed to an Experience site which is restricted to authenticated users. - An Enhanced Chat channel deployed to a custom site or app which has its own authentication mechanism outside of Salesforce. - An enhanced third-party Messaging channel, such as Apple Messages for Business. In each configuration, you can exercise full control over the actions that your agents perform. To ensure your agent operates within the parameters you define, carefully consider how to manage and limit agent actions. Depending on your company policies, you may decide not to require true authentication for your agents to take all or any private actions. ## Authenticating Experience Site Users (Enhanced Chat) When your Agentforce Service agent is deployed to an Experience site that is restricted to authenticated users, each Agentforce messaging session comes automatically with an active and authenticated AuthSession. Because the user’s Account and Contact IDs are known, it’s relatively straightforward to assign those values to the respective fields in the MessagingSession record. Each private action should be configured to confirm that these values are assigned and that the identified AuthSession is still active before the action can be completed. ## Authenticating Users From an External Site or App (Enhanced Chat) When your Agentforce Service agent is deployed to a custom site or app that has its own authentication mechanism outside of Salesforce, map your Agentforce messaging session to a MessagingSession record. The [User Verification feature](https://help.salesforce.com/s/articleView?id=service.user_verification_overview.htm&language=en_US) can help by allowing your custom site or app to securely pass a user identifier, which is saved to the [MessagingEndUser](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_messagingenduser.htm) record. For example, if you use email addresses as an identifier, private actions can be configured to parse an email address in the MessagingEndUser record as confirmation of the user’s identity. This method of managing authentication doesn’t automatically track an authenticated AuthSession, so there’s no immediate way to invalidate authentication after granting it. Authentication is valid until the expiration date embedded in the token is reached. Define the expiration dates according to your company’s standards. ## Identifying Users in Third-Party Messaging Channels When your Agentforce Service agent is deployed to an enhanced third-party Messaging channel, such as Apple Messages for Business, build authentication into the flow of the interaction for the Agentforce Service agent to take private actions.
Authentication Method Details
Authenticate users via channel identifiers.

Depending on your company policy, channel-specific identifiers can be used for authentication. This method isn’t without risk. Using channel-specific identifiers for authentication purposes means delegating your authentication to the channel provider, and you should carefully consider your authentication requirements before doing so.

Should you decide to delegate authentication to your channel provider, implement Channel Object Linking to automatically tie the Contact to the associated messaging session. Then, configure private actions to reference this information before being completed.
Authenticate users via a side channel.

If you can’t use channel-specific identifiers for authentication, configure your Agentforce Service agent to authenticate users via a side channel. Although you’re no longer relying on the channel provider’s identifier, the conversation is still secured by that provider. If a malicious user can spoof or otherwise assume someone else’s identity on that channel, they can likely do the same after the session is authenticated over the side channel.

Authenticating users via a side channel is a variant of authenticating Experience site users, in that it delegates authentication to an existing web authentication mechanism. To implement this, pass the MessagingSessionId via a query parameter to a site that implements the required authentication. Then, when the server for that site receives the authenticated request for that MessagingSessionId, it should be configured to use the Salesforce API to update the MessagingSession record with the identifiers retrieved from the authentication mechanism.
Authenticate using messaging components. In enhanced third-party Messaging channels such as Apple Messages for Business, Agentforce Service agents can send authentication messaging components to the messaging end user (MEU). In this process, the MEU receives an authentication prompt on their device, allowing them to complete the authentication using a standard authentication provider such as Facebook or Google. You can also configure custom authentication providers.
## Limiting the Scope of Private Actions After a user's identity is confirmed, private actions can use the Session ID to enforce the scope of private actions based on the associated account ID and contact ID. Using the Session ID guarantees that the action is limited as intended. For example, the [Get Order By Order Number](https://help.salesforce.com/s/articleView?id=ai.copilot_actions_ref_get_order_by_order_number.htm&type=5&language=en_US) action can be configured to pull the contact ID from the MessagingSession record before looking up any order information. `//Get Contact from Session SELECT Id, contactId__c FROM MessagingSession WHERE sessionId =: SessionId //Get orders based on Contact from Session SELECT Id, Status FROM Order WHERE ContactId =: ms.contactId__c AND orderNumber =: orderNumber` You can configure other private actions similarly, ensuring that Agentforce Service agents provide authenticated users with only their own data.