Salesforce Wants to Govern Every Agent. Who Governs Salesforce?
Salesforce used Dreamforce 2026 to make its most ambitious agent governance claim so far. It seeks to go well beyond the governance of agents running on Salesforce. Through MuleSoft Agent Fabric and its announced AI Control Plane, Salesforce is positioning itself as the layer through which enterprises discover, manage and govern agents across the wider technology estate.
This breadth creates a structural problem. The platform running Agentforce seeks to also supply the control plane, the identity and policy mechanisms, the monitoring and much of the evidence used to assess it. This may be effective operational governance, but it raises a potential conflict of interest.
The challenge facing enterprises is familiar. John Locke argued that people cannot be trusted to judge their own cases because self-interest makes them partial. A well-ordered society therefore needs a known and impartial judge with authority over every party. The same principle applies here. Salesforce leaves enterprises in control of their agent estates while offering to judge its own agents alongside those of its competitors.
Veqtor8 published ten principles for independent agentic AI governance in May 2026. Salesforce offers an especially useful test because its Dreamforce governance proposition extends beyond its own platform. MuleSoft describes Agent Fabric as ‘the neutral solution’ for enterprises using agents from several vendors. This claim deserves scrutiny because reach across competing platforms does not by itself establish independence from Salesforce.
The central thesis is that no platform can independently govern itself. I have used the ten principles to assess both the strengths of Salesforce’s approach and the limits of platform-led governance. The assessment draws on Dreamforce announcements, Salesforce product information, public reporting and conversations with technology decision makers.
The ten principles
Architectural independence. The governance layer operates above the platform estate as continuously running infrastructure, accountable to none of the platforms it observes.
Governance for operational excellence and resilience. Governance exists to make the enterprise better run and remains available if any platform in the estate becomes unavailable.
Data portability and sovereignty. Governance evidence is owned by the enterprise, held in formats it controls and producible to an auditor without any vendor’s cooperation.
Data governance as a foundation. Unified cataloguing, classification, lineage, quality monitoring and semantics hold their meaning across platforms.
Federated architecture. Signals are ingested from any platform, normalised into a common governance model and presented as one view.
Reduced vendor concentration. Governance avoids recreating the concentration risk it seeks to manage.
Cyber and identity governance across machine boundaries. Identity is tracked consistently for people, agents, workflows, service principals and model-to-model connections, including across platform boundaries.
Continuous cross-platform auditability. Evidence is captured as activity occurs, including the data that crossed a boundary, the authority under which it moved and its governance state at the time.
Agent accountability and ownership. Every agent carries a named owner, an authorisation record, defined operational limits and a decommissioning process.
Independent quantification of AI risk and value. Risk and return are measured using sources with no financial interest in the answer.
Salesforce’s agentic governance stack
At Dreamforce, Salesforce presented its governance proposition as a connected stack. The Trusted Enterprise AI Harness brings together Data 360, Informatica, MuleSoft Agent Fabric, Tableau, Agentforce, Salesforce Guardian and the wider Salesforce platform, with the aim of connecting data, integration, identity, security, monitoring and governance around enterprise agents.
Agent Fabric provides the cross-platform layer, with agent discovery, a registry and budget controls. The AI Control Plane, announced immediately before Dreamforce, is intended to add identity, policy, lifecycle, performance and cost management across Salesforce and third-party AI. Salesforce Guardian builds on Salesforce Shield to address agent identity, rogue agents, data classification and data protection. Informatica and Data 360 supply the catalogue, lineage and business context agents rely on, and Agentforce Observability records activity inside Agentforce sessions.
AIforce, the headline launch, extends Salesforce’s control boundary beyond its own applications. It lets users and agents reach Salesforce data, permissions and workflows from other AI tools, including Claude and Slack, without working inside Salesforce. Salesforce’s permission model therefore becomes more important because activity originating elsewhere can still lead to actions inside Salesforce.
The complete proposition is still developing. The unified Harness is not expected to be generally available until early fiscal 2028, which begins in February 2027, and pricing has not been disclosed.
Salesforce assessed against the ten principles
I have assessed Salesforce against each of the ten principles. The results fall into three groups.
Strong alignment with agent accountability and ownership, and with data governance as a foundation.
Mixed alignment with federated architecture, cyber and identity governance across machine boundaries, continuous cross-platform auditability, and independent quantification of AI risk and value.
Limited alignment with architectural independence, governance for operational excellence and resilience, data portability and sovereignty, and reduced vendor concentration.
Strong alignment
Agent accountability and ownership
The first governance challenge created by a growing agent estate is knowing which agents exist and who is responsible for each one. The announced Control Plane is designed to provide registration, identity, policy and lifecycle management for Salesforce and third-party agents. Agent Fabric can record each agent’s capabilities, data sources and lineage, while Guardian is intended to let enterprises apply policies to individual agents and separate an agent’s identity from that of the person it represents.
Together these capabilities can give each agent an identity, an owner, an authorised purpose and a lifecycle, which is strong alignment with the principle. The main qualification is timing, since some of the unified management experience remains on the roadmap. The depth of control available for a third-party agent will also depend on the telemetry and enforcement points exposed by the native platform.
Data governance as a foundation
Data governance is one of Salesforce’s strongest capabilities. Its acquisition of Informatica gives it the ability to catalogue and trace data across warehouses, lakehouses and SaaS applications, rather than limiting governance to data held within Salesforce. Data 360’s zero-copy architecture also lets agents use data held in supported external platforms without moving it into Salesforce. The AWS integrations announced around Dreamforce extend this reach to Iceberg tables, Aurora and RDS.
Enterprises will need common definitions, continuous lineage and clear ownership for data held outside Salesforce, including data created or changed by agents. The strength of the foundation will depend on whether or not those controls survive as data moves between platforms.
Mixed alignment
Federated architecture
Agent Fabric is designed for an environment in which enterprises use agents from several vendors. Salesforce says it can discover and connect agents built in Agentforce, Amazon Bedrock, Google Vertex AI and Microsoft Copilot Studio. That reflects the reality of most large enterprise technology estates.
The test is its ability to produce one reliable governance view rather than a larger collection of registered agents. Enterprises will need to establish which signals Agent Fabric receives from each external platform, if it interprets them consistently and if the same policies can be enforced across all of them. An agent’s presence in the registry does not guarantee the same depth of visibility or control.
Cyber and identity governance across machine boundaries
An agent acting for a user should have its own identity and permissions, rather than simply inheriting the user’s authority. Guardian separates agent identity from user identity, while AIforce requests remain subject to existing Salesforce permissions. These controls are necessary, but they address only part of the identity problem.
The bigger challenge arises as work passes between agents and platforms. A request that begins in Claude and ends with a change to a Salesforce record crosses the identity systems of two companies. Salesforce claims that Agent Fabric and Guardian can preserve the chain. Enterprises need to test whether the record identifies every agent, user, permission and delegation involved, including changes in authority at each handoff.
Continuous cross-platform auditability
Agentforce Observability records detailed session evidence. Its Session Tracing Data Model captures user input, planner decisions, prompts, actions, errors and final responses, while multi-agent traces follow delegation among Agentforce agents. Editable scoring prompts allow each enterprise to define its own measures of success.
Salesforce also supports session downloads and is developing export through OpenTelemetry, an open industry standard. Through Agent Fabric and Guardian, it claims to extend this record across agents and platforms. The completeness of the trail will depend on the evidence each external platform exposes and the depth of Salesforce’s integration with it. Enterprises should test whether a trace follows an action beyond a Salesforce-visible handoff and records the data, authority and governance state at every stage.
Independent quantification of AI risk and value
Dreamforce placed unusual emphasis on the economics of agents. Agent Fabric Wallets assign budgets to individual agents, while Agentforce Observability tracks consumption and performance. Salesforce also presented an ROI playbook for customers.
These tools give enterprises a clearer view of agent costs, but Salesforce still defines and reports the measures. Enterprises need to assess cost, risk and business value using their own evidence across the whole agent estate.
The limits of platform-native governance
The remaining four principles test whether governance can remain independent, resilient, portable and replaceable when one provider supplies much of the underlying stack.
Architectural independence
Agent Fabric can discover and connect agents built on several competing platforms, giving Salesforce reach across a mixed agent estate.
But the Control Plane remains a Salesforce product, sold and operated by Salesforce. It governs Agentforce alongside external agents while producing much of the evidence used to assess them. Its reach may extend beyond Salesforce, but its architecture remains dependent on Salesforce. Independent oversight requires a separate layer that does not depend on any platform it governs.
Governance for operational excellence and resilience
A common registry, consistent policy, session tracing and cost controls help enterprises deploy more agents without losing visibility, and this operational role is a legitimate part of governance.
During Dreamforce, Salesforce experienced a global service disruption affecting hundreds of instances, and customers reported severe delays, intermittent errors and an inability to reach some services. Salesforce initially attributed the problem to requests stalling while waiting for an internal login service. Reports said access to the newly launched AIforce services, including the Claude integration, was also disrupted.
Outages affect every major provider. The test is whether governance evidence, policy enforcement and operational visibility remain available while the governed platform is down. If the agent environment and its governance layer share the same operational dependency, the enterprise can lose both at once. Independent governance provides continuity across that failure boundary.
Data portability and sovereignty
Salesforce has taken useful steps towards evidence portability. Session data can be downloaded, OpenTelemetry export offers an open format for observability data, and the wider data proposition supports zero-copy access rather than moving all operational data into the platform.
The governance record still depends heavily on Data 360 and Salesforce’s data models. Export coverage and retention constraints determine the amount of evidence an enterprise can preserve, and some export capabilities remain in beta. The principle requires the enterprise to hold a complete record in systems and formats it controls and to produce it without the vendor’s cooperation. Salesforce provides extraction mechanisms, but extraction is not sovereignty.
Reduced vendor concentration
The Trusted Enterprise AI Harness combines data, integration, identity, security, models, monitoring and governance within one commercial relationship. This can simplify deployment for customers already invested in Salesforce, and it can also make governance another source of concentration risk.
Dreamforce announcements included Gemini, models available through Amazon Bedrock and Salesforce’s own Koa model, and Agent Fabric connects agents from several platforms. Greater choice among models and agents can nonetheless coexist with deeper dependence on Salesforce as the layer that discovers, connects and governs them. The more governance evidence accumulates there, the harder the control plane becomes to replace.
The hubris of self-governance
The executives who highlighted safety at Dreamforce run the companies that are building, selling and scaling the very systems that create the risk.
Marc Benioff told Fortune that responsibility for AI safety has to sit with the companies building the technology. He suggested product liability law could provide accountability, much as carmakers are liable for faulty vehicles. Sam Altman argued that a small group of AI companies should not make decisions that belong to the wider world, while saying he believed the industry could keep safety ahead of capability.
The idea that the powerful can police themselves is not new. In Plato’s Republic, the suggestion that a guardian should need a guardian of his own is dismissed as ridiculous because the guardians would be educated to govern themselves. Benioff’s position follows similar logic and runs into a similar problem. Responsibility describes the duty a company owes. Accountability requires someone outside the company who can check that the duty has been met.
Benioff’s own analogy works against his argument. Carmakers are liable for faulty vehicles, but the safety ratings buyers trust come from independent programmes such as Euro NCAP and the Insurance Institute for Highway Safety, which is funded by insurers rather than manufacturers. The party that builds the car is not the party that rates it. Finance teaches the same lesson. A company prepares its own accounts, but an independent auditor signs them off, and nobody sees this as a slight on the finance team.
Each wave of powerful technology has eventually produced an independent industry to test, measure and control it. Finance produced the external audit. The motor industry produced independent crash testing. Enterprise software produced penetration testing and independent security assessment. Agentic AI needs the same counterweight, and it cannot come from the companies building the agents.
Product liability and the threat of lawsuits do introduce an external check, but they are reactive, expensive and uneven. They respond to harm after it occurs rather than preventing it. Independent safety assessment works before deployment, sets common standards and gives buyers a basis for comparison that does not depend on vendor claims.
The hubris lies in the assumption that the builders of a technology are best placed to judge it. Guardian, Agent Fabric and the AI Control Plane would use Salesforce technology, methods and evidence to assess agents built on Salesforce infrastructure. Even if these tools are effective, they are internal controls, not independent audits. A platform cannot independently govern itself, and an industry cannot create independent accountability by appointing its own leaders as overseers.
Implications for enterprises
Enterprises running Agentforce have good reasons to use Salesforce’s governance capabilities, which provide operational control an organisation would otherwise have to build or assemble itself. Four practical steps follow from the assessment.
Use Salesforce governance for operational control and an independent layer for enterprise oversight. Agent Fabric, Guardian and Agentforce Observability can manage activity inside the Salesforce environment and provide a broader view of external agents, but they should not be the enterprise’s only view of the estate.
Retain governance evidence continuously. Export session traces, identity records, policy decisions, cost information and incident evidence into systems the enterprise controls, and test completeness, timing and retention before an investigation makes those details urgent.
Test the cross-platform claim. Establish which external agents Agent Fabric can discover, the telemetry it receives from each platform and the policies it can enforce. Registration in a common catalogue should not be confused with equivalent governance depth.
Measure risk and value independently. Use Salesforce cost and performance data as inputs, then assess outcomes against enterprise measures that cover all agents and do not depend on the commercial interests of any platform provider.
A judge in its own cause
Salesforce is helping create the governance problem it now proposes to solve, and Dreamforce showed the mechanics. It launched seven named agents, a Long-Horizon Runtime that lets agents pursue tasks over longer periods with less human involvement, and multi-agent orchestration that lets those agents delegate work to one another. AIforce and the earlier Headless 360 initiative open Salesforce data and workflows to agents running in Claude, Slack and other third-party tools. Each step puts more agents in more places, acting for longer and across more platform boundaries, and each increases the evidence an enterprise needs to govern them. Salesforce then offers the Control Plane to govern an estate its own products have expanded, while consumption-based pricing means its revenue grows as agent activity grows.
Other platform providers follow a similar pattern, but Salesforce proposes to occupy an unusually broad position in the chain. It would build and operate agents, hold much of the data they use and govern the wider estate they form.
Salesforce seeks to assess its own agents alongside those of its competitors using evidence assembled through its products, while earning more as agent activity grows. As more agents and governance records pass through that environment, replacing its control plane becomes harder.
Locke’s answer
In an earlier piece, I argued that agentic AI needs a Leviathan with the authority to impose order. Locke adds an essential qualification. The authority governing the system must itself be constrained and accountable.
Locke’s remedy for partial judges was an established and impartial judge with authority over every party, together with a separation between the power to make rules and the power to carry them out, because holding both is too great a temptation. He also insisted that people retain the right to replace a government that breaks their trust.
Each idea has a counterpart in agentic AI governance. An impartial judge is a governance layer accountable to none of the platforms it observes, as the principle of architectural independence requires. Separating rule-making from execution means the authority that sets and assesses agent policy should sit apart from the platforms that run the agents. The right to replace a governor depends on the enterprise holding its own governance evidence, which is the purpose of data portability and sovereignty. Accountability to the governed means the enterprise, rather than the vendor, decides if an agent earns its keep, its trust and its budget.
Every enterprise needs order across its agent estate. Hobbes establishes the need for authority, while Locke establishes its limits. The architects of the problem cannot be its only judges, and enterprises need an independent way to check.
Andrew Milroy is the founder of Veqtor8, an independent technology advisory firm focused on AI, cybersecurity, cloud and data management.
This article reflects the author’s opinion and analysis based on Dreamforce 2026 announcements, publicly available product information, press coverage and conversations with technology buyers and users.
Comments