AgentForce is Salesforce's agent platform — GA October 2024, now branded AgentForce 360. Atlas Reasoning Engine for the loop, five-attribute model (Role / Data / Actions / Guardrails / Channel) for the agent definition, Data Cloud for the data substrate, Einstein Trust Layer for the security wrapper. Pre-built agents ship for Service and Sales; custom agents are built in a low-code builder against Salesforce metadata. Flex Credits ($0.10 / credit) is the consumption price — not a per-seat licence. This is the vendor-bound first-party agent platform for businesses already on Salesforce; not a framework you'd choose otherwise.
AgentForce is a closed, Salesforce-hosted runtime for building and running agents that act on Salesforce data and adjacent systems. It is not a Python library you import. It is a configured product, built and deployed inside a Salesforce org, that exposes agents to humans through Slack, the Salesforce UI, voice channels, websites embedded in Experience Cloud, and APIs. Pre-built first-party agents ship for the common Salesforce workflows: Service Agent (Service Cloud case deflection and resolution), Sales Coach (rep coaching during deals), SDR Agent (lead engagement), and Personal Shopper (Commerce Cloud). Custom agents are built in the AgentForce Builder, a low-code graph editor that defines the agent's behaviour, the actions it can take, and the data it has access to.
The product GA'd at Dreamforce in October 2024. The current generation is AgentForce 360, with AgentForce 3 introducing MCP-server interop and the AWS partnership ("AgentForce 360 for AWS") deepening the AWS-hosted deployment path. The marketing pitch is "digital labour" — agents as headcount on a per-action consumption basis rather than per-seat licensing.
The technical claim to attend to is the Atlas Reasoning Engine. Salesforce describes it as the "brain" of AgentForce: a Reason-Act-Observe (ReAct) loop combined with a graph-based deterministic engine. The LLM provides flexible reasoning; AgentForce Script (the deterministic flow layer) ensures predictable behaviour on the parts that must not vary. Hybrid reasoning is the term Salesforce uses for the combination.
The Frameworks band on this hub holds open-source SDKs (ADK, LangGraph, CrewAI, AutoGen) and first-party vendor SDKs (OpenAI Agents SDK, Anthropic Agent SDK). AgentForce is a different shape: it is a vendor-bound platform, not a library or SDK. You don't import it; you configure it inside a Salesforce org. That binding is the constraint and the strength — it ships with Salesforce metadata, security, audit trail, and the entire Customer 360 data graph as table stakes. If you are not on Salesforce, AgentForce is not a credible option. If you are on Salesforce, the alternative path (build an ADK or LangGraph agent against the Salesforce REST API) loses every "deep integration with the platform" advantage AgentForce starts with.
The Atlas Reasoning Engine is Salesforce's name for the agent runtime that drives every AgentForce agent. The published architecture is a ReAct loop — reason, act, observe, repeat — combined with a graph-based deterministic engine that lets the builder pin certain parts of the conversation to fixed flows. This is the "hybrid reasoning" Salesforce talks about: LLM flexibility for the open-ended parts, deterministic flow for the parts where unpredictability is not acceptable.
The model considers the user's intent against the agent's role, available actions, and the data it can access. It picks a next step (call an action, ask for clarification, hand off).
The agent invokes an action — an Apex method, a Flow, a Data Cloud query, an MCP tool exposed via MuleSoft, or a handoff to a human or another agent.
The result of the action comes back as new context. The loop checks whether the goal is reached or whether more steps are needed. The model may ask the user a mid-task clarifying question.
"Reinforcement learning and feedback loops" appear in the Atlas marketing copy. In practice the production behaviour comes from three things working together: a foundation model picked at the org level (OpenAI / Anthropic / Google or Salesforce's own models), the agent definition (the five attributes, below), and AgentForce Script — the graph layer where the builder explicitly defines flow steps that don't go through the LLM. The agent definition + the graph + the model are what make a particular agent behave the way it does.
An LLM asked to "process a return request and refund the customer" is great at understanding intent and writing the email but unpredictable at the policy boundary. Salesforce's argument is that this boundary — "Did this customer's policy allow a refund?" — should be a deterministic flow step, not a model judgement. The AgentForce Builder lets you assemble agents where the model handles conversation and reasoning, but specific decision points are fixed graph nodes that always execute the same logic. Determinism where it matters; flexibility where it doesn't.
Every AgentForce agent is defined by five attributes. Together they specify what the agent is supposed to do, what it can access, what it can do, what it must not do, and where it operates. The five-attribute model is the unit of agent definition in AgentForce; everything else is configuration.
| Attribute | What it specifies |
|---|---|
| Role | The agent's job or purpose. Service Agent. Sales Coach. SDR. A natural-language statement that frames every model call. |
| Data | What knowledge and records the agent can read — Salesforce objects, Data Cloud profiles, knowledge articles, external sources via MuleSoft. |
| Actions | The capabilities the agent can invoke — existing Apex methods, Flows, prompt templates, MCP tools, REST callouts. Each is registered as an action the agent can pick during the ReAct loop. |
| Guardrails | Boundaries and restrictions — never escalate without approval, never quote a price outside this range, hand off to a human if the user mentions specific keywords. |
| Channel | Where and how the agent operates — Slack, Salesforce UI, voice (phone), website embed, MuleSoft-exposed API endpoint. |
Before any prompt leaves the Salesforce platform for a model provider, the Einstein Trust Layer applies dynamic grounding (retrieves the right Data Cloud records for context), secure data retrieval (enforces user-level Salesforce sharing rules so the model only sees data the calling user could see), data masking (PII can be tokenised before transmission), and zero data retention (the model provider commits not to retain or train on the prompt or completion). On the way back, the response is checked for toxicity. This is the contractual basis on which a POPIA Information Officer or a SOC 2 auditor signs off on AgentForce processing customer data.
AgentForce moved from per-conversation pricing to Flex Credits in May 2025. Each credit is $0.10 USD. An AgentForce action is 20 credits ($2.00). An AgentForce Voice action is 30 credits ($3.00). You pay for what you use; there's no per-seat licence for the agent itself. This is the "digital labour priced like a contractor" pitch.
| Unit | Cost (USD) | Notes |
|---|---|---|
| 1 Flex Credit | $0.10 | The base unit. |
| AgentForce action | 20 credits · $2.00 | One agent execution that performs an action. |
| AgentForce Voice action | 30 credits · $3.00 | Voice channel; higher cost reflects the synthesis + recognition surface. |
Three payment models layer over Flex Credits:
| Mode | How it works | When to use |
|---|---|---|
| Pay-as-you-go | No upfront commitment. Pay monthly based on credits consumed. | Pilots, testing new use cases, unpredictable workloads. |
| Pre-commit | Commit to an annual usage; unlock discounted per-credit pricing. | Steady-state production workloads with known volume. |
| Pre-purchase | Buy credits upfront, draw down through the contract term. | Budget envelopes; mitigating mid-year price risk. |
AgentForce ships with a "Digital Wallet" usage monitor — near real-time credit consumption, threshold alerts, usage trends. For an SA business worried about FX-driven cost surprises on a USD-priced consumption product, the Digital Wallet is the operational guard rail. Set thresholds, set alerts, treat AgentForce credits like a cloud-cost line item rather than a SaaS subscription.
| Concern | AgentForce | ADK / LangGraph / Anthropic SDK |
|---|---|---|
| Shape | Hosted platform inside Salesforce | Open-source library you import |
| Where it runs | Salesforce-managed (Hyperforce) | Anywhere you host it |
| Pricing | Flex Credits ($0.10) + Salesforce licence + Data Cloud licence | Open source. You pay only for the model. |
| Data integration | Salesforce + Data Cloud out of the box; MuleSoft for the rest | Wire it up yourself |
| Compliance | Einstein Trust Layer ships with audit, masking, zero-retention | You build the trust layer yourself |
| Model flexibility | Model-pluggable (OpenAI / Anthropic / Google / Salesforce xGen) | Model-pluggable (any provider) |
| Lock-in | High — the agent definition is metadata only inside Salesforce | Low — the agent is your code |
| Best fit | Salesforce-heavy enterprise; agents acting on CRM data | Anything else, especially multi-vendor stacks |
If >60% of the data and actions an agent needs to touch live inside Salesforce, AgentForce is usually the right pick — you inherit the platform's data graph, identity model, audit trail, and trust layer for free. If <30%, you're better off with an open framework that doesn't pretend to be a system of record. The middle is where it gets interesting: a MuleSoft-shaped enterprise can extend AgentForce reach via MCP servers, but the more reach you push outside the org, the less of AgentForce's value proposition you're actually using.
FX exposure is the operational reality. Flex Credits are USD-priced. Every AgentForce action costs ZAR-times-the-spot-rate. For SA businesses, the unit-economics conversation needs an FX model: "AgentForce digital labour is cheaper than human labour at R18/USD" becomes a different conversation at R22/USD. Pre-commit pricing locks in a discount but not the exchange rate; pre-purchase locks in the credit balance but charges in USD up front. Build the FX sensitivity into the business case before sign-off.
POPIA via the Trust Layer. The Einstein Trust Layer's "zero data retention" guarantee with foundation-model providers is the contractual claim that lets an SA Information Officer sign off on AgentForce processing personal information — OpenAI / Anthropic / Google commit not to retain or train on Salesforce-sent prompts and completions. The Trust Layer also enforces user-level Salesforce sharing rules at retrieval time, which means an agent acting on behalf of a service rep cannot see records that the service rep cannot see. POPIA Section 19 ("appropriate, reasonable technical and organisational measures") has a clean evidence trail.
Data residency is a Hyperforce question. AgentForce runs inside Hyperforce. There is no Hyperforce datacenter in South Africa as of mid-2026 — SA orgs typically land in the Frankfurt or Ireland clusters. Section 72 cross-border-transfer questions need to be raised at contract time, and the SCC equivalents that Salesforce offers should be part of the procurement package. The Trust Layer's masking and zero-retention guarantees are the supporting controls, but residency itself is upstream.
The SI partner conversation. AgentForce setup — especially a useful one, with Data Cloud connected and the right agent guardrails — is partner-led work, not a self-serve sign-up. The SI partner ecosystem in SA is substantial; the right conversation up front is "scope and time to value", not "platform cost". Most poorly-performing AgentForce deployments fail at the agent-design step, not the platform-cost step.