Salesforce Agentforce & Agent Script Guide (2026) | Architecture & Career Roadmap

Agentforce is Salesforce's platform for building AI agents that plan, reason, and act inside the Salesforce ecosystem — not just chatbots that answer questions, but agents that can autonomously execute business processes. The technical core that matters most for consultants right now is Agent Script, a compiled, declarative language (GA'd in early 2026) that introduces hybrid reasoning: blending deterministic, rules-based execution (IF/ELSE logic the LLM cannot override) with generative, LLM-driven reasoning in the same engine. Scripts compile into an Agent Graph consumed by Salesforce's Atlas Reasoning Engine. Everything runs inside the Einstein Trust Layer, which enforces zero data retention, prompt-injection defenses, and standard Salesforce access controls automatically. As of April 2026, Salesforce renamed "Topics" to "Subagents" to better reflect their role as specialized agents with distinct expertise — a terminology shift worth knowing, since a lot of still-circulating content hasn't caught up.

Key facts at a glance

• Agent Script is a compiled, declarative language, not a runtime-interpreted script — saved versions compile down into an Agent Graph consumed by the Atlas Reasoning Engine.
• Hybrid reasoning combines a deterministic layer (IF/ELSE, guaranteed action sequences, hard rules the LLM cannot override) with a generative layer (LLM-powered natural language and contextual reasoning) in the same execution flow.
• "Topics" were renamed to "Subagents" in Salesforce's April 2026 refreshed Agentforce Guide — an explicit alignment with broader industry terminology.
• Two authoring modes exist: natural-language/Canvas UI for rapid prototyping, and direct Agent Script authoring (via Agentforce DX and a VS Code extension) for full developer control, version control, and CI/CD.
• Deterministic actions (run @actions.<name>) execute every time a subagent/topic is parsed — useful for guaranteed data-fetching before reasoning starts. Reasoning actions (tools) are exposed for the LLM to invoke subjectively based on context.
• The Einstein Trust Layer provides secure data retrieval, dynamic grounding, prompt-injection defenses, toxicity detection, and strict zero data retention — and agents respect standard Salesforce access controls automatically, without a separate security model.
• Data 360 powers grounding via RAG — Agentforce Data Libraries (ADLs) for unstructured data, with a default auto-configured vector store/search index/retriever, or fully custom retrieval setup for more control.
• The Agentforce Testing Center lets you validate agent performance and reliability, including safely testing utterances and conversational scenarios, ideally within a Sandbox before production deployment.

What Agentforce Actually Is (Beyond the Marketing Language)

Salesforce's own framing draws a specific technical line: agents are different from other generative AI tools because they can plan, reason, and act — not just generate text. An agent understands a question (an "utterance"), autonomously reasons about what actions are needed to reach a goal, identifies what data it needs, and then takes action — with or without human intervention depending on how you've configured it.

The part that matters most for anyone evaluating this seriously for production use: agents use LLMs to handle natural language and intent, but Agentforce also uses Agent Script to enforce specific business logic that the LLM cannot override. This is the hybrid reasoning model, and it's the direct answer to the objection every risk-averse stakeholder eventually raises — "LLMs are probabilistic, our business rules aren't, how do you reconcile that?" Salesforce's answer isn't "trust the model more." It's "don't let the model decide the things that must never vary."

The platform architecture as of the Agentforce 360 release consists of four components: the Agentforce 360 Platform itself, Data 360 (grounding and analytics), Customer 360 Apps, and Slack — reflecting a deliberate push to put agents where work already happens (inside Slack, inside existing CRM workflows) rather than in a separate standalone interface.

Agent Script: The Feature That Actually Changed the Platform

Before Agent Script, building an Agentforce agent meant configuring topics and actions and then hoping the LLM reasoned through them correctly at runtime — the LLM was both the brain and the decision-maker. That works for open-ended conversation. It falls apart the moment a business requirement is "if this condition is true, you MUST do this, no exceptions" — because LLMs are fundamentally probabilistic, and business rules aren't.

Agent Script changes this by compiling your instructions into an Agent Graph — a structured specification the Atlas Reasoning Engine actually executes — rather than relying purely on prompt-level hoping. Two distinct layers exist within the same script:

• Deterministic layer — IF/ELSE conditions, guaranteed action sequences, variable assignments. These execute exactly as written; the LLM cannot override them.
• Generative layer — prompts that let the LLM generate natural language, interpret ambiguous input, and reason contextually within the boundaries the deterministic layer sets.

What this actually looks like in practice, using the real syntax patterns:

# Deterministic action — runs every time this subagent is parsed,
# regardless of what the LLM decides. Used for guaranteed data-fetching
# before reasoning begins.
run @actions.get_order_status

# A conditional block — pure deterministic logic, LLM cannot deviate
if order.total > 100:
    run @actions.apply_free_shipping
else:
    | Let the customer know standard shipping rates apply.

# A reasoning action (tool) — exposed to the LLM, which subjectively
# decides whether to invoke it based on conversational context
reasoning.actions:
    - @actions.check_inventory
    - @actions.escalate_to_human

# A direct subagent reference — behaves like a standard tool call;
# once the delegated subagent completes, control returns here
@topic.escalation_handler

A few syntax details worth knowing cold if you're going to work with this directly: Agent Script is whitespace-sensitive, using indentation to indicate structure — much like Python or YAML, which makes it genuinely readable and diffable in version control rather than opaque prompt text. The pipe character (|) prefixes prompt instructions — natural language sent directly to the reasoning engine for the LLM to interpret. Reasoning instructions inside a subagent are processed sequentially, top to bottom — Agentforce parses them in order, resolves variables and prior action outputs into a concrete assembled prompt, and only then sends that fully-resolved natural language result to the LLM. The LLM never sees your raw script.

Why this matters for consultants specifically: because Agent Script is compiled and integrates with Agentforce DX and a full VS Code extension, agent definitions can now live in source control, go through code review, and flow through CI/CD pipelines — the same discipline you'd apply to Apex or any other Salesforce metadata. If your prior mental model of "building an Agentforce agent" was purely point-and-click configuration in Setup, that model is now genuinely outdated for anyone doing serious production work.

The Terminology Shift Almost Nobody's Blog Has Caught Up To

Worth stating explicitly because it will confuse anyone reading slightly older material: Salesforce renamed "Topics" to "Subagents" in its refreshed April 2026 Agentforce Guide. The reasoning given is that "subagents" better reflects their actual role — specialized agents with specific domain expertise — and aligns Salesforce's terminology with broader industry conventions around multi-agent systems.

Functionally, nothing about the mechanism changed — when a customer message comes in, the Reasoning Engine determines which subagent should handle the request, exactly as it previously determined which "topic" applied. But if you're reading a certification guide, a blog post, or even internal documentation written before roughly April 2026, expect to see "topic" used for what current material calls a "subagent." Both terms describe the same architectural concept; only the label changed.

The Atlas Reasoning Engine and Agentforce Studio

The Atlas Reasoning Engine is what actually consumes the compiled Agent Graph and executes it at runtime — determining subagent routing, executing deterministic actions, and orchestrating when the LLM is invoked versus when hard-coded logic takes over.

Agentforce Studio (referenced in Salesforce's own updated guide as the unified workspace) is where you build, test, and monitor agents in one place — spanning the Canvas visual editor, direct Agent Script authoring, and testing/monitoring tooling, rather than these being separate disconnected tools.

Three authoring entry points exist, at increasing levels of control:

1. Conversational description — describe desired behavior in plain language ("if the order total is over $100, then offer free shipping") and Agentforce automatically generates the appropriate topics/subagents, actions, instructions, and expressions. The lowest-barrier entry point, suited to business users and admins.
2. Canvas / block-based editor — a visual editor where Agent Script appears as summarized, expandable blocks, with shortcut syntax (/ for common expression patterns like conditionals and transitions, @ to reference resources like subagents, actions, and variables).
3. Direct Agent Script authoring — full manual control via Agentforce DX, for developers who want precise control over deterministic hooks, tool chaining, and subagent transitions.

The practical guidance for consultants: start prototyping in Canvas for speed, but plan to graduate genuinely production-critical logic — anything with hard compliance or financial rules — into direct Agent Script, specifically because that's where you get explicit, auditable, version-controlled deterministic hooks rather than logic embedded inside a natural-language prompt that's harder to review and guarantee.

Trust and Governance: The Einstein Trust Layer

This is the part of Agentforce that answers the security question every enterprise stakeholder asks before agents touch real customer data or take real actions.

The Einstein Trust Layer is described by Salesforce as a secure AI architecture natively built into the platform — not a separate product bolted around Agentforce. Its documented guardrails include:

• Secure data retrieval and dynamic data grounding — ensuring agents pull from trusted, contextually relevant data rather than whatever an LLM might otherwise fabricate
• Prompt injection defenses — checking AI responses for attempts to execute unauthorized actions or reveal restricted information, and filtering malicious prompt patterns before they reach the model
• Toxicity detection
• Strict zero data retention — all data accessed by agents, including PII, is protected in transit and is explicitly not stored or used for training by external LLM providers
• Standard Salesforce access controls, inherited automatically — agents respect your existing permission model rather than requiring a parallel access-control system to be configured and maintained

One specific, easy-to-miss operational detail: data masking through the Einstein Trust Layer is disabled by default specifically to improve agent performance and accuracy — meaning agents generally see real underlying data rather than masked placeholders. For any regulated industry (healthcare, financial services), this is a configuration point that needs explicit, deliberate review during design — not an assumption to carry over from how masking might work elsewhere in the platform.

For more granular behavioral control beyond the platform-wide Trust Layer, you configure subagent instructions — setting boundaries, defining context, and constraining behavior per subagent — and Salesforce provides an instruction adherence metric specifically to measure how well an agent is actually interpreting and following those instructions in practice, rather than just assuming compliance.

Grounding Agents in Real Data: Data 360 and RAG

An agent is only as good as the data it's grounded in, and Salesforce's answer here is Data 360 powering retrieval-augmented generation (RAG).

RAG mechanics as implemented: retrieve relevant information from a knowledge base via a retriever, augment the original prompt by combining it with that retrieved information, then generate the response — standard RAG architecture, but wired natively into the platform rather than requiring you to stand up separate vector infrastructure.

Two implementation paths exist, at different levels of effort and control:

• Agentforce Data Libraries (ADLs) — the low-effort path. Add a data library in Agentforce Builder or Setup, and Salesforce automatically builds a complete RAG solution using default settings for the vector data store, search index, and retriever. Note the constraint: ADLs only support unstructured data.
• Direct Data 360 implementation — more setup effort, but significantly more control: broader data source variety, custom chunking and ingestion strategy, and precise retrieval mechanisms beyond basic search — including hybrid search (combining keyword and vector search) and ensemble retrievers for more sophisticated retrieval scenarios.

The practical decision point for a consultant: ADLs are the right default for a first agent or a straightforward unstructured-knowledge-base use case (policy documents, product FAQs). Reach for direct Data 360 implementation when you need structured data grounding, custom chunking control (e.g., ingesting CRM records with long unstructured text fields that need deliberate chunking strategy), or retrieval quality that basic keyword/vector search alone doesn't achieve.

Testing Before Production: The Agentforce Testing Center

Given that agents can autonomously execute business processes — not just suggest actions for a human to approve — testing discipline before production deployment isn't optional. The Agentforce Testing Center is Salesforce's dedicated tooling for this: validating agent performance and reliability, and specifically allowing you to safely test utterances and conversational scenarios to improve how accurately the agent understands and responds, before any of that testing touches live customer interactions.

The recommended workflow: test in a Sandbox first — ideally a Full Copy Sandbox, which mirrors production metadata, object schemas, and workflows with high fidelity — specifically so you can rigorously stress-test agent reasoning parameters and any integrations without risk to the live org. This mirrors a discipline any experienced Salesforce consultant already applies to Apex and Flow deployments; the difference with agents is that the "logic" you're testing is partly probabilistic, which makes systematic utterance testing (not just functional testing) a genuinely new and necessary practice, not an optional nice-to-have.

Real Use Cases Across the Platform (2026 Releases)

Salesforce's Spring and Summer 2026 releases show where Agentforce is actually being deployed in production, not just demoed:

• Agentforce Sales (Sales Cloud rebranded) — autonomous agents handling inbound lead generation, lead nurturing, and sales management. Agentforce Account Management AI can perform deep research into an account's company, business priorities, and industry trends ahead of a sales meeting — and these management agents are directly accessible inside Slack, letting reps update opportunities and research accounts without leaving the Slack interface.
• Einstein Conversation Insights (ECI) — now natively stores data on the Salesforce platform (rather than a separate analytics layer), making it directly usable in standard reports and automations like Flow and Apex. ECI also combines call summaries and generative insights across both voice and video into a single feature, plus Vendor Transcript Processing for third-party call recording sources.
• Agentforce Voice — extending agent interaction into a natural, on-brand voice channel rather than text-only.
• Automotive and Communications industry agents — pre-configured templates like warranty claims agents with goodwill repair process automation, showing Salesforce's push toward industry-specific out-of-the-box agent templates rather than only horizontal, generic ones.
• Headless 360 — a notably different architectural pattern: decoupling business logic and agent intelligence from any specific UI, letting an organization build an AI interface anywhere (a custom app, a voice channel, an entirely custom experience) while still inheriting the full AI Trust Layer's permissions and guardrails automatically — described by Salesforce as avoiding a separate security review for every new surface added.

Certification and Career Roadmap

Certified Agentforce Specialist is the primary Agentforce-focused certification path, aimed at professionals responsible for managing and optimizing Agentforce with a combined understanding of Salesforce platform configuration and Agentforce-specific capabilities. No formal prerequisites are required, though foundational Salesforce platform knowledge is genuinely assumed.

What the exam actually covers, based on Salesforce's own published exam guide:

• Explaining how an agent works and how the reasoning engine powers Agentforce
• Managing deterministic behavior using filters and variables, given a use case — i.e., you're expected to reason about hybrid reasoning design, not just definitions
• Using the Agentforce Data Library to improve response accuracy and personalization, including chunking and indexing considerations for unstructured data
• Identifying retriever considerations in Data Cloud/Data 360 — including individual versus ensemble retrievers and search type tradeoffs (keyword, vector, hybrid)
• Using the Agentforce Testing Center to validate agent performance and reliability
• Prompt design discipline: including guardrails and constraints in prompts, assigning role/context, making prompts reusable, and iterative testing/refinement

A separate, complementary certification — Certified Data 360 Consultant — targets professionals implementing and consulting on the enterprise data platform underneath Agentforce's grounding capabilities, relevant for anyone whose role leans more toward the data/RAG architecture side than agent behavior design itself.

A realistic roadmap for a Salesforce consultant or admin:

1. Build foundational platform certification first if you don't already have it (Administrator or Platform-level) — Agentforce Specialist assumes this baseline even without formally requiring it.
2. Start hands-on in Canvas mode with a simple, low-stakes agent — a straightforward internal-facing use case, not a customer-facing production agent — to build intuition for topics/subagents, actions, and reasoning instructions.
3. Deliberately build at least one agent using direct Agent Script authoring, not just Canvas — the certification exam explicitly tests deterministic behavior management, and that's genuinely harder to internalize without having written the IF/ELSE logic yourself.
4. Work through the Agentforce Data Library and Data 360 grounding modules on Trailhead — retrieval and grounding quality is where a large share of real production agent problems actually originate, not agent "reasoning" per se.
5. Use the Agentforce Testing Center on a real agent before considering yourself exam-ready — the scenario-based exam questions reward having actually debugged an agent's utterance handling, not memorized definitions.
6. Pursue Certified Agentforce Specialist, and consider Certified Data 360 Consultant as a natural pairing if your role touches data architecture as much as agent design.

For consultants coming from other ecosystems (Oracle, SAP): the conceptual parallels are strong even though the tooling differs completely — hybrid reasoning (deterministic + generative in one engine) parallels the design tension every enterprise AI agent platform is converging on right now, including Oracle's Workflow Team node graphs. If you already think in terms of "where do I need guaranteed, auditable behavior versus where can I let the model reason flexibly," that instinct transfers directly, even though Agent Script's specific syntax is unique to Salesforce.

Interview Questions (With the Answers That Signal Real Understanding)

"What is hybrid reasoning, and why does it matter for enterprise agents?" Hybrid reasoning is Agentforce's approach to combining probabilistic, LLM-based reasoning with deterministic, rules-based execution in the same engine. It matters because pure LLM reasoning can't guarantee "if X, then Y, no exceptions" behavior that business rules require — Agent Script's deterministic layer enforces those guarantees while still letting the LLM handle genuinely ambiguous, conversational interpretation.

"What's the difference between a deterministic action and a reasoning action (tool) in Agent Script?" A deterministic action, invoked via run @actions.<name>, executes every single time its containing subagent is parsed — regardless of what the LLM decides — useful for guaranteed data-fetching before reasoning begins. A reasoning action is exposed in a reasoning.actions block, and the LLM subjectively decides whether to invoke it based on conversational context.

"How does Agentforce keep an agent from acting on data a user shouldn't have access to?" Agents inherit standard Salesforce access controls automatically through the Einstein Trust Layer, rather than requiring a separate, parallel security model to be built and maintained for AI specifically. Combined with subagent-level instructions for finer behavioral boundaries, this is the same layered governance approach as securing any other part of the Salesforce platform.

"Why would you choose direct Data 360 implementation over an Agentforce Data Library for grounding?" ADLs only support unstructured data and use default auto-configured retrieval components — fast to stand up, but limited control. Direct Data 360 implementation is warranted when you need structured data sources, custom chunking strategy, or more sophisticated retrieval like hybrid search or ensemble retrievers — genuine control at the cost of more setup effort.

"What changed between 'Topics' and 'Subagents' in Agentforce terminology, and does it change how agents actually work?" Purely a naming change made in Salesforce's April 2026 refreshed guide, explicitly to better reflect that these are specialized agents with distinct expertise, aligning with broader industry terminology. The underlying mechanism is unchanged — the Reasoning Engine still determines which subagent (formerly "topic") handles a given request.

"How would you test an agent before letting it interact with real customers?" Use the Agentforce Testing Center to systematically validate performance and reliability, including safe utterance and conversational-scenario testing, within a Full Copy Sandbox that mirrors production metadata and schema — treating this as necessary as functional testing, not optional, precisely because agent behavior is partly probabilistic rather than purely deterministic code.

Best Practices

1. Push genuinely critical business logic into deterministic Agent Script, not natural-language prompt instructions — "the LLM cannot override this" is a real guarantee only in the deterministic layer.
2. Prototype in Canvas, graduate to direct Agent Script authoring for anything production-critical, specifically to get version control and code review discipline.
3. Default to Agentforce Data Libraries for straightforward unstructured knowledge bases; reach for direct Data 360 implementation only when you genuinely need structured-data grounding or advanced retrieval.
4. Explicitly review the data-masking-disabled-by-default setting for any regulated-industry deployment — don't assume protections you haven't verified are active.
5. Test in a Full Copy Sandbox with the Agentforce Testing Center before any production deployment — treat utterance/scenario testing as a mandatory discipline, not a nice-to-have.
6. Use subagent instructions and instruction adherence metrics to measure actual behavioral compliance, not just assumed compliance from having written an instruction.
7. Update your terminology — "Subagents," not "Topics," in any documentation, training material, or client-facing conversation going forward.
8. Treat the Trust Layer's guardrails as the baseline, not the ceiling — add subagent-level constraints for anything genuinely sensitive rather than relying purely on platform defaults.

FAQ

What is Agent Script in Salesforce Agentforce? A compiled, declarative language for building and governing Agentforce agents. It combines a deterministic layer (IF/ELSE logic, guaranteed action sequences the LLM cannot override) with a generative layer (LLM-driven natural language reasoning) in a single engine — an approach Salesforce calls hybrid reasoning. Scripts compile into an Agent Graph consumed by the Atlas Reasoning Engine.

What happened to "Topics" in Agentforce? They were renamed to "Subagents" in Salesforce's April 2026 refreshed Agentforce Guide, to better reflect their role as specialized agents with distinct expertise and align with broader industry terminology. The underlying mechanism — the Reasoning Engine routing a request to the appropriate one — is unchanged.

Is Agentforce secure enough for regulated industries? Agentforce runs through the Einstein Trust Layer, which provides secure data retrieval, dynamic grounding, prompt-injection defenses, toxicity detection, and zero data retention, and agents inherit standard Salesforce access controls automatically. That said, specific settings — like data masking being disabled by default for performance reasons — require deliberate review for regulated use cases rather than being assumed safe out of the box.

What's the difference between an Agentforce Data Library and direct Data 360 implementation for grounding? ADLs are a fast, low-effort path supporting only unstructured data, with Salesforce auto-configuring the vector store, search index, and retriever using defaults. Direct Data 360 implementation takes more setup but supports structured data, custom chunking, and advanced retrieval methods like hybrid search and ensemble retrievers.

What certification should a Salesforce consultant pursue for Agentforce? Certified Agentforce Specialist is the primary path, testing reasoning engine understanding, deterministic behavior management, Data Library and retriever considerations, and use of the Agentforce Testing Center. Certified Data 360 Consultant is a strong complementary certification for consultants whose role leans toward the underlying data/grounding architecture.

How is Agentforce different from building a custom AI chatbot on top of Salesforce data via API? The core difference is hybrid reasoning and native trust/governance. A custom chatbot built externally has to reconstruct security, grounding, and any deterministic guarantees itself. Agentforce agents inherit Salesforce's access controls automatically, use Agent Script to guarantee specific business logic the LLM can't override, and are grounded through natively-integrated Data 360 RAG rather than a hand-built retrieval pipeline.

Closing Thoughts

The single most useful mental shift for a Salesforce consultant approaching Agentforce right now isn't learning prompt engineering — it's recognizing that Agent Script turned agent-building into a discipline that looks a lot more like the platform engineering work you already do. Deterministic logic that must never vary, reasoning left flexible where ambiguity genuinely exists, version-controlled definitions that go through CI/CD, and systematic testing before production — that's the same rigor Salesforce architects already apply to Apex and Flow, now extended to a layer that happens to reason with natural language. The terminology will keep shifting as the platform matures (as "Topics" already became "Subagents" in a matter of months) — but the underlying discipline of separating what must be guaranteed from what can be left to genuinely intelligent judgment is the skill worth building now, and it's transferable well beyond Salesforce specifically.