Trust, Security, Governance, and Testing of Agents
Trust is layered
The Einstein Trust Layer sits between the agent and the model: secure retrieval, dynamic grounding, data masking of sensitive fields, zero data retention by the model provider, toxicity detection, prompt-injection defences, and an audit trail of interactions. Trust Cards document a model's characteristics. Platform security - permission sets, least-privilege agent users, MFA, Shield capabilities such as Event Monitoring, Field Audit Trail, and Transaction Security - governs what the agent can touch.
Governance decisions
Decide up front: which actions may write, which require explicit confirmation, when the agent must hand off to a human, what is logged, and who reviews transcripts. Escalation paths and refusal behaviour are requirements, not polish. For public sector work, minimisation matters - mask or omit identifiers the task does not need.
Testing
Agentforce testing tools let you define scenarios and utterance tests: a sample constituent utterance, the topic or action you expect, and the outcome you assert. Run batches after every change to prompt, topic description, model, or action contract, because the planner is probabilistic - a passing test today is evidence, not proof. Supplement with red-teaming: ambiguous requests, out-of-scope asks, adversarial prompts, and requests for another person's data.
Traps
- Zero retention applies to the model provider, not to your own audit logs - retention of internal logs is your policy.
- Agents run with a user's permissions; testing with an over-privileged admin hides real access failures.
- Toxicity scores detect; they do not automatically block unless you configure it.
- A single successful demo conversation is not a test suite.
Rule of thumb
For every new action, write three tests: the happy path, an ambiguous utterance that should still route correctly, and a request that must be refused or escalated.