Skip to content
Bluejayders
System 05 · Vendor platform · CRM & ITSM

Salesforce Agentforce — and ServiceNow, for contrast

The other four systems on this pack are things a company built for itself. This one is the pattern most enterprises will actually deploy: a vendor platform with the intent classifier, reasoning loop, action registry and trust layer already assembled. It is also the best-documented example of intent classification in the whole pack — Agentforce's Topics are its classifier, and the mechanism is fully public.

6action types
5agent attributes
response relevance (pilot)
+33%end-to-end accuracy (pilot)
ReActnot chain-of-thought
A2A / MCPcross-agent protocols
Topics ARE the intent classifier

A Topic maps to one user intent or job to be done. Classification is prompt-based against each topic's natural-language classification description, not a trained classifier. In newer terminology each request maps to a subagent — “the AI's job description for that moment” — which defines what actions are valid and which policies apply.

The topic is also the guardrail

Because a Topic bounds the action set the planner may choose from, misclassification cannot produce an out-of-scope action. That structural containment is more robust than prompt-level instructions, and it is the design idea worth stealing.

Vendor material, read accordingly

Unlike the Uber and LinkedIn pages, most sources here are product documentation and marketing. Mechanics from developer.salesforce.com, help.salesforce.com and the Salesforce Engineering blog are reliable; pilot performance claims (2×, +33%) are vendor-reported and uncontrolled.

L1

System context

agentforce — L1 system context
CHANNELSAGENTFORCESALESFORCE PLATFORMOUTSIDE THE PLATFORMCustomer / employeeWeb chat & Enhanced Chat v2Slack · WhatsApp · SMS · emailVoiceAgent API (REST)headless agentsinvoke Agentforce from anywhereand from OTHER agentsAgentforce agentRole · Data · Actions ·Guardrails · ChannelAtlas Reasoning Engine insideEinstein Trust Layersecure data retrieval · dynamic groundingdata masking · zero retentiontoxicity detection · audit trailData Cloudretrievers · search indexhybrid keyword + vector retrievalService Cloud / Sales Cloudcases · contacts · ordersOmni-Channel routingFlow · Apex · Prompt Templatesdeclarative and pro-code actionsMuleSoftTopic Center: define Topics andActions AT API DESIGN TIMEAnypoint API catalogueExternal / legacy systemsERP · billing · logistics ·mainframe · third-party SaaSLLM providersreached only through the Trust LayerHuman agentOmni-Channel escalation withfull conversation contextAgentforce Testing Centertest action outcomes, inputs, outputs,planning accuracy, TOPIC CLASSIFICATIONand planner stateSession tracing exportOpenTelemetry API for Agentforcesession tracesgroundingretrievalread + writerecordsinvoke actionsexternal APIactionsEVERY model callmasked prompt ·zero retentionOmni-Channelescalationspans
drag to pan · scroll to zoom · click any box
actorapp / surfaceagent / reasoningmodel callstore / indexexternal systemguardrail / trustplatform / gatewaypipeline / evalnot shippeddashed = inferred— api call— data— llm call— human loop— guardrail— escalation— external
L2

Full request pipeline — classification, reasoning, actions, trust

Read left to right for the request path; the bottom strip is the Einstein Trust Layer, which wraps every model call rather than sitting at one point in the flow. The action block in the middle is the answer to “how do agents connect to external systems” — six distinct mechanisms, from no-code Flow to MuleSoft API to MCP.

agentforce — L2 topics, atlas reasoning loop, actions and trust layer
INPUT & CONFIGURATIONTOPIC / INTENT LAYERATLAS REASONING LOOPACTIONS — HOW THE AGENT REACHES EVERYTHING ELSETARGETSEINSTEIN TRUST LAYER — WRAPS EVERY MODEL CALLsecure data retrieval → dynamic grounding → masking → gateway → detection → un-masking → auditInbound messagefrom any channel or the Agent APIAgent configurationRole · Data · Actions ·Guardrails · Channeldeclarative, YAML-backedSession lifecycleAgent API session start → messages→ session end · variables carriedTOPIC CLASSIFICATIONa Topic = one user intent / job to bedonematched on the topic's CLASSIFICATIONDESCRIPTION in natural languageTopic scopea Topic BOUNDS which actions are validand which instructions apply— the primary safety mechanismInstructionsnatural-language guidance on HOWto use the actions in this topicAtlas Reasoning Engineinference-time “System 2” reasoningReAct loop: reason → act → observeasynchronous, event-driven, graph-basedStateshort-term AND long-term memorypast interactions, user data, contextSide effectsactions that change the environment:updating records, initiating tasksRetrievers over Data Cloudhybrid keyword + vector retrievalsearch index over unified dataAction selectionthe planner picks from the actionsthe classified topic permitsFlow actionsmulti-step processes, record ops,business logic — no codeApex actionspro-code custom logicExternal Services / OpenAPIregister an OpenAPI spec as an actionMuleSoft API actionsTopic Center defines Topics + Actionsmetadata AT API DESIGN TIMEenterprise/legacy connectivityPrompt Template actionsa grounded generation stepinvoked as an actionAgent Actions / MCPinvoke other Agentforce agentsand MCP-exposed toolsExternal systemsERP · billing · logistics · mainframeSalesforce recordscases · contacts · ordersSecure data retrievalgrounds ONLY with data the executinguser can access — respects role-basedcontrols and field-level securityDynamic groundinghappens at RUN TIME and depends onthe user's access; evolves as theconversation continuesData maskingsensitive items → tokens before theprompt leaves for an external LLMregex + metadata-driven detectionZero retention + toxicityscoringprompt and response not retainedby the provider; output scoredAudit trailtracks a prompt through EVERY step:what data, what prompt, what response,what action — all inside SalesforceOmni-Channel escalationhand to a human with full contextTesting Centeraction outcomes · inputs · outputsplanning accuracy · topic classification· planner stateutteranceclassified topic /subagentvalid action setgrounding queryplan steprecord read/writeobserve → re-planEVERY model calluser-scoped onlycannot resolve
drag to pan · scroll to zoom · click any box
actorapp / surfaceagent / reasoningmodel callstore / indexexternal systemguardrail / trustplatform / gatewaypipeline / evalnot shippeddashed = inferred— api call— data— llm call— human loop— guardrail— escalation— external
Action typeCategoryWhat it reaches
FlowDeclarative / low-codeMulti-step processes, record operations, business logic — no custom code
Prompt TemplateDeclarative / low-codeA grounded generation step, invoked as an action
ApexPro-codeArbitrary custom logic on the platform
External ServicesPro-code / integrationAny OpenAPI-described REST API registered as an invocable action
MuleSoft APIEnterprise integrationLegacy and enterprise systems at scale. Topic Center defines Topics and Actions metadata at API design time, so existing API investment becomes agent-callable.
Agent Actions / MCPAgent-to-agentOther Agentforce agents, and MCP-exposed tools
Atlas: what it actually does

Three components define a generic agent: State (short- and long-term memory), Flow (the logical framework guiding next steps), and Side Effects (actions that impact the environment). On top of that, five attributes: Role, Data, Actions, Guardrails, Channel. The loop is explicitly ReAct — reason, act, observe — until the goal is met, with clarifying questions allowed mid-loop.

Why it scales

Salesforce's stated fix for early bottlenecks: replace synchronous, tightly-coupled components with a publish–subscribe, event-driven graph of strongly-typed function nodes, so tasks run concurrently and each module scales independently. Modules communicate through “strongly typed well-publicized interfaces.”

Trust Layer, four mechanisms

Secure data retrieval — grounding uses only data the executing user can access, respecting role-based controls and field-level security. Dynamic grounding — assembled at run time, evolving with the conversation. Data masking — sensitive values tokenised before leaving for an external LLM. Audit trail — every prompt tracked through every step.

L3

Critical path — message to external API call to CRM update

agentforce — L3 request sequence
ARTIFACT / DETAILCustomerTopic classificationAtlas Reasoning EngineData Cloud retrieverEinstein Trust LayerMuleSoft → external APIService Cloud / human"Where is my order and can I stillchange the address?"1Arrives over any channel — web chat, Slack, WhatsApp,voice, or the Agent API for headless use.match utterance against topicCLASSIFICATION DESCRIPTIONS2Agentforce's intent classifier is prompt-based, not atrained model. Each Topic carries a natural-languageclassification description. Result: a topic — or in newerterminology a SUBAGENT.topic → valid action set +instructions3This is the primary safety mechanism: the topic BOUNDSwhich actions the planner may even consider. Guardrailsare structural, not just prompted.REASON → grounding query4Hybrid keyword + vector retrieval over Data Cloud. Loopiteration 1.retrieve — SECURE DATA RETRIEVAL5"the prompt is grounded only with data that the executinguser has access to." Role-based controls and field-levelsecurity are respected at retrieval time, not filteredafterwards.DYNAMIC GROUNDING — assembled at run time6Grounding is dynamic because it happens at run time anddepends on the user's access — and it evolves as theconversation continues.ACT → select action from thepermitted set7Action types available: Flow, Apex, Prompt Template,External Services (OpenAPI), MuleSoft API, and AgentActions / MCP.invoke MuleSoft API action → logistics system8MuleSoft Topic Center lets teams define Topic and Actionmetadata AT API DESIGN TIME, so existing API investmentbecomes agent-callable without new glue code.OBSERVE → shipment status + address-change window9The ReAct loop: reason → act → observe, repeating untilthe goal is fulfilled. New information can triggerre-planning or a clarifying question.generation request10DATA MASKING: sensitive items substituted with tokens viaregex and metadata-driven detection BEFORE the promptreaches an external LLM. Zero data retention applies.toxicity scoring + un-maskresponse11Every step is written to the AUDIT TRAIL: what the agentdid, what data it accessed, what prompt it generated, whatresponse it received, what action it took.grounded reply12Atlas pilot results Salesforce published: 2× responserelevance and +33% end-to-end accuracy versus competitorand DIY systems.SIDE EFFECT: update the case record13"Actions performed by agents to impact their environment,such as updating records or initiating tasks."or: escalate via Omni-Channel with full context14When the topic has no valid action for the request, or thecustomer asks for a person.
drag to pan · scroll to zoom
actorapp / surfaceagent / reasoningmodel callstore / indexexternal systemguardrail / trustplatform / gatewaypipeline / evalnot shippeddashed = inferred— api call— data— llm call— human loop— guardrail— escalation— external
ALT

ServiceNow — the same problem, a different centre of gravity

Worth putting side by side. Agentforce centres on one agent with a topic router; ServiceNow centres on orchestrating many agents across a workflow engine. The Orchestrator is a meta-agent — “a digital manager, assigning tasks, sequencing actions, and ensuring the right agent executes the right task at the right time.”

servicenow — AI agent platform
SERVICENOW AI PLATFORM — THE CONTRAST CASEdifferent centre of gravity: orchestration of MANY agents across a workflow engine, vs Agentforce's single-agent topic routerEmployee / customer / fulfillerNow Assistthe conversational surface acrossITSM · CSM · HR · SecOpsAI Agent Orchestratora META-AGENT that coordinatesteams of AI agents toward a goalassigns tasks, sequences actionsAI Agent Studiobuild and customise agents via anatural-language interfaceset guardrails, define toolsDomain AI agentsITSM · CSM · HR · SecOpsAI Agent Fabricunifies THIRD-PARTY agents and toolsfrom any platform, over theAgent2Agent (A2A) protocolAction Fabric / workflowsagents act through Now Platformworkflows and record operationsAzure OpenAI GPT-4.1orchestration layer, on ServiceNow-managed Azure serversNow LLMdomain-specific in-house modelsused by AI Agent toolsWorkflow Data Fabriczero-copy federation of enterprise dataRaptorDB as the platform data storeAI Control Towercentral hub to manage, monitor andgovern ANY AI — incl. third-partyThird-party agents & toolsreached via A2A through the Fabricdelegate toexternal agentsA2A
drag to pan · scroll to zoom · click any box
actorapp / surfaceagent / reasoningmodel callstore / indexexternal systemguardrail / trustplatform / gatewaypipeline / evalnot shippeddashed = inferred— api call— data— llm call— human loop— guardrail— escalation— external
Salesforce AgentforceServiceNow
Intent layerTopic classification against natural-language classification descriptionsAI Agent Orchestrator routes to specialised domain agents
ReasoningAtlas Reasoning Engine — ReAct loop, event-driven graphOrchestrator as meta-agent, sequencing agent teams
Build surfaceAgent Builder, Agent Script, Agentforce DXAI Agent Studio — natural-language agent authoring
External connectivityMuleSoft, External Services (OpenAPI), Apex, Agent Actions / MCPAI Agent Fabric over the A2A protocol; Action Fabric; Workflow Data Fabric for zero-copy data federation
ModelsMultiple providers behind the Einstein Trust LayerAzure OpenAI GPT-4.1 for orchestration on ServiceNow-managed Azure; Now LLM domain models for agent tools
GovernanceEinstein Trust Layer + Agentforce Testing Center + OTel session tracingAI Control Tower — central governance across any AI, including third-party