Know what your Agentforce agent is allowed to do, before it goes live
Since the week of 13 July 2026, Salesforce creates new agents only in the new Agentforce Builder, which uses Agent Script: a single file that sets out everything the agent can do. We read that file with fixed rules and give your client a sealed record of every action the agent can take, who decides when it acts, and what blocks go-live.
The sealed go-live record
Salesforce’s tools check that an agent’s script compiles and let you test how it behaves. Neither gives a board an independent, sealed record of what the agent is allowed to do before it goes live. The Agent Authority Record does.
- 1
Export the agent file
One command with the Salesforce CLI. The file holds the agent’s design, not customer data.
- 2
The rules run
Every action is listed with what it calls, whether the AI or fixed logic decides when it runs, and any condition that limits it. Same file, same result, every time.
- 3
A sealed record comes back
In your branding, ready for the client’s board or risk team to sign off at handover. Change the agent and the seal stops matching, so every release gets a fresh record.
We tested it on Salesforce’s own sample agent
Salesforce’s own Local Info Agent, from its public Agentforce test-drive project on GitHub, unchanged (see the file). Salesforce’s compiler accepts it. Gaps like these are expected in a sample. The point is that nothing at compile time flags them, so an agent built from a template can carry them through to go-live. Our record found:
No route to a human
Run-as user not set
Two actions with no condition
The record covers what the agent file says, and nothing else. It doesn’t check what the Apex, Flows and APIs behind each action can do, settings in the Salesforce org, or whether the file is the version deployed. Live records are digitally signed and the public key is published, so anyone can check a record hasn’t been altered, without asking us.
The Agent Authority Record is issued under CLEARANCE, our post-deployment product, and also offered through AQE. Salesforce and Agentforce are trademarks of Salesforce, Inc. This check is independent and not affiliated with or endorsed by Salesforce.
Qualifying the whole project?
Before the build starts, AQE’s 24-question assessment checks whether the data, ownership and team are ready, and returns a clear verdict. See how AQE works.
Partners serving charities
For migrations to Agentforce Nonprofit, the Agentforce Nonprofit partner preview shows the checks you can deliver under your own name. Read how partnering works.
Your first agent check is free.
Send one Agent Script file and get the findings back. No card required. The findings are free. The sealed, signed record is the paid part, and you set the price to your client.
Your file is used only to produce the findings, seen only by John Akinmade, deleted within 30 days unless you ask us to keep it, and never used to train AI. Privacy · Terms