AI Security

⚡ Key Points: 1-Minute Summary It's Built-in, Not a Button: The Einstein Trust Layer is an architectural foundation providing zero data retention, toxicity scoring, and audit trails. Masking Exceptions: Contrary to popular belief, data masking for LLMs is disabled for Agentforce agents. It primarily applies to embedded AI features. Apex Callouts Bypass It: Direct Apex callouts to external systems step outside the Trust Layer boundary entirely. Prerequisites Matter: You cannot even view the Trust Layer settings page until Salesforce Data Cloud (Data 360) is properly configured in your org. 💬 In plain words: The Einstein Trust Layer is a real, structural security boundary—but it's heavily misunderstood. Two critical facts get overlooked: data masking doesn't apply to active Agentforce agents, and building direct Apex callouts leaves the Trust Layer behind entirely. 📌 Real-Life Example: A developer builds a custom Ap...

⚡ Key Points: 1-Minute Summary Four Security Layers: Agentforce protects data using a strict four-layer model encompassing User Context, Field-Level Security (FLS), Sharing Rules, and the Einstein Trust Layer . The Trust Layer is Built-In: The Einstein Trust Layer operates at an architectural level. It handles zero-retention agreements, toxicity scoring, and PII masking automatically before data reaches external LLMs. Direct Apex Callouts Bypass Protections: If you build direct Apex callouts to external LLMs instead of using standard Agentforce actions, the Trust Layer is bypassed. You are solely responsible for data masking and audit logging. Never Bypass Sharing: Custom agent actions utilizing Apex should always enforce security using with sharing and USER_MODE .