Playbook · Technical Guide

How Agentforce Works: The Complete Technical Guide for Decision-Makers

Agentforce is not a chatbot with better NLP. This guide explains the Atlas Reasoning Engine, Topics and Actions architecture, Einstein Trust Layer, and how agents actually take action in your systems — written for technical buyers who need to understand what they are deploying, not just what it promises.

12 min readJune 2026By Kovil AI Engineering Team

What is Agentforce? (Not Einstein Copilot)

Agentforce launched in October 2024 as a fundamental architectural departure from Einstein Copilot. The distinction matters because the two products are often confused, and deploying them interchangeably leads to misaligned expectations and failed implementations.

Einstein Copilot is a reactive assistant. A human asks it a question, it generates a response. It suggests the next action, the human decides whether to take it. It does not execute autonomously. It is a productivity layer on top of human decision-making.

Agentforce is an autonomous agent. It observes a trigger (a new lead, an incoming customer message, a scheduled event), reasons through a multi-step plan, executes Actions in your systems (updating records, calling APIs, sending emails), and determines its own next step — all without a human in the loop for standard cases. The human is only involved when the agent explicitly escalates.

Agentforce
  • Autonomous multi-step reasoning
  • Action execution (not suggestion)
  • Atlas Reasoning Engine
  • Enterprise guardrails via ETL
  • Priced per conversation
Einstein Copilot
  • Reactive copilot (human drives)
  • Suggestion generation
  • Basic prompt-response model
  • Integrated into Salesforce UI
  • User-based licence

The four building blocks of every Agentforce agent

Every Agentforce agent is built from four components. Understanding how they relate to each other is the foundation of every implementation.

Topics — the agent's job description

Each Topic defines the scope of queries the agent handles, the instructions for how to handle them, and which Actions the agent can use within that scope. An agent can have multiple Topics — each covering a distinct type of interaction. The Atlas Reasoning Engine selects the appropriate Topic based on the content of the user's message and the active conversation context.

Topics should be scoped narrowly. “Handle all customer service” is not a Topic — it is a department function. “Respond to inbound loan status queries from authenticated customers” is a Topic. The narrower the Topic, the more precise the Instructions can be, the higher the resolution rate, and the more predictable the agent's behaviour.

Actions — what the agent can do

Actions are the capabilities the agent can invoke. There are five types:

Flow-based actions: Trigger Salesforce Flows — update records, send emails, create tasks, post Chatter messages. The most common action type for standard CRM operations.

Apex actions: Invoke custom Apex classes for business logic that cannot be expressed in Flow — complex calculations, conditional routing, data transformation.

API callout actions: Make HTTP callouts to external REST APIs via Apex. Used for integrating with non-Salesforce systems without MuleSoft.

MuleSoft actions: Enterprise-grade integration with external systems via MuleSoft Anypoint Platform. Provides advanced transformation, monitoring, and governance for complex integration patterns.

Prompt actions: LLM-based text generation for drafting emails, summaries, and structured responses. Grounded in CRM data via Data Cloud or direct record context.

Instructions — the guardrails and behaviour rules

Instructions are the most important — and most underestimated — component of an Agentforce agent. They define what the agent must always do, what it must never do, and how to handle edge cases. Instructions are written in natural language and interpreted by the Atlas Reasoning Engine at runtime.

Vague Instructions produce unpredictable agents. Precise Instructions — specifying exact escalation conditions, explicit “never do” constraints, and clear handling logic for ambiguous situations — produce agents that behave consistently in production. The quality of your Instructions is the single largest determinant of your autonomous resolution rate.

Guardrails (Einstein Trust Layer) — the security perimeter

The Einstein Trust Layer operates as the outer security perimeter around all agent AI operations. It runs before and after every LLM interaction: blocking prompt injection attempts (where a user tries to manipulate the agent by embedding instructions in their message), filtering PII from data before it is sent to the LLM provider, enforcing zero data retention at the LLM level, and generating an immutable audit trail of every action the agent takes.

The Trust Layer is what makes Agentforce deployable in regulated industries. Without it, enterprise deployments in financial services, healthcare, or legal would be non-starters from a compliance perspective.

A common misconception: the Einstein Trust Layer is not optional security configuration you turn on for sensitive deployments. It is the core architecture of every Agentforce interaction. Every prompt goes through it, every action is logged by it. Understanding this matters because it affects your compliance documentation — you are not deploying a raw LLM in your org. You are deploying an LLM behind a trust boundary with audit logging, PII filtering, and injection protection built in.

The Atlas Reasoning Engine: four-phase loop

Atlas does not process one message and generate one response. It runs a continuous four-phase reasoning loop throughout the entire conversation — re-evaluating context, executing actions, and reflecting on outcomes at every step.

Phase 1 — Observe

Reads the conversation and loads customer context

Atlas reads the incoming message and the full conversation history. It loads customer context from the CRM — Account record, related Cases, Opportunities, or any configured Data Cloud unified profile. It identifies intent: what is the user asking for, what is the implied need behind the stated request, and what context is most relevant to forming a response. Observation is not passive — Atlas actively queries structured data sources as part of the observe phase.

Phase 2 — Plan

Determines which Topic applies and plans the execution sequence

Based on observed context and intent, Atlas determines which configured Topic is most relevant to the current interaction. Within that Topic, it identifies which Actions are needed to address the user's request and in what order they should be executed. For complex requests requiring multiple steps — retrieve data, update a record, send an email, confirm with the user — Atlas plans the full sequence before beginning execution.

Phase 3 — Act

Executes Actions — Apex calls, Flow triggers, MuleSoft API calls, record updates

Atlas executes the planned Actions in sequence. Flow Actions trigger Salesforce Flows. Apex Actions invoke custom business logic. API callout Actions connect to external systems. Record Actions read and write CRM data. Each Action returns a result that informs the next step. If an Action fails (external API returns an error, Flow encounters an exception), Atlas routes to the configured fallback behaviour rather than surfacing a raw error to the user.

Phase 4 — Reflect

Evaluates outcome and determines next step or escalation

After executing the planned Actions, Atlas evaluates whether the outcome meets the resolution criteria defined in the Topic Instructions. Did the Action succeed? Does the user's response indicate the issue is resolved? Is further action needed? If the goal is met, the agent closes the conversation or offers additional help. If not, Atlas re-enters the plan-act loop with updated context. If the situation exceeds the agent's defined scope, Atlas triggers the configured escalation path.

How data flows through an Agentforce interaction

Here is a step-by-step walkthrough of a real Agentforce interaction — a customer requesting a product return through a Service Cloud Messaging channel.

1

Customer sends message via web chat

Customer types: "I received the wrong item in my order #SF-29847. I want to return it." The message arrives in Service Cloud Messaging and triggers the Agentforce agent.

2

Atlas identifies intent and loads context

Atlas reads the message, identifies intent (product return, wrong item), and loads the customer's Account record, the relevant Order record for #SF-29847, and the product return policy from the Knowledge base.

3

Atlas selects the Product Returns Topic

Based on intent, Atlas routes to the Product Returns Topic. This Topic has access to: Get Order Action, Check Return Eligibility Action, Create Return Case Action, and Send Confirmation Email Action.

4

Atlas executes: Get Order, Check Eligibility

Get Order Action retrieves #SF-29847 from the Order object — confirms it was delivered 3 days ago (within 30-day return window) and identifies the shipped SKU. Check Return Eligibility confirms the item is eligible.

5

Atlas creates the return case and updates records

Create Return Case Action creates a new Case record with type='Return', reason='Wrong Item', and links it to the order. The original order record is updated with return_requested=true.

6

Agent responds and sends confirmation

Atlas generates a response confirming the return initiation, provides the Case number, and sends a return label email via the Send Confirmation Email Action. The response is grounded in the actual Case number and return window data — not templated language.

7

Reflect: issue resolved

Atlas evaluates whether the customer's request is resolved. It confirmed the wrong item, initiated the return, and sent the label. Resolution criteria met. Conversation marked as autonomously resolved. Audit log entry created.

Agent channels: where Agentforce appears

Agentforce agents are not a single-channel product. They can be deployed across multiple touchpoints, each with different technical setup requirements and use case fit.

Service Cloud Messaging
Web chat, SMS, WhatsApp, Facebook Messenger. The most common deployment channel for customer-facing service agents.
Experience Cloud portals
Self-service portals for customers, partners, or employees. Embedded directly in portal pages.
Slack
Internal agent deployments for employee-facing use cases — IT helpdesk, HR queries, finance approvals.
Email
Agents that monitor incoming email, classify intent, and respond or route automatically.
Voice (partner integrations)
Voice channel integration via Salesforce's partner ecosystem. Available but requires additional configuration.
Salesforce CRM UI
Agents embedded directly in the Salesforce interface for rep-facing and internal operations use cases.

Agentforce vs. traditional chatbots: six key differences

Capability
Agentforce
Traditional chatbot
Intent recognition
Dynamic LLM-based reasoning
Fixed keyword matching / NLU
Multi-step reasoning
Full plan-act-reflect loop
Single-turn responses
CRM integration
Native Salesforce data access
Limited or none
Action execution
Executes records, emails, APIs
Suggestions only
Escalation handling
Structured HITL with full context
Simple queue transfer
Audit trail
Immutable log via ETL
Typically none

Data grounding: how agents get accurate information

An agent is only as accurate as the data it can access. Agentforce has multiple mechanisms for grounding agent responses in verified, structured information rather than relying on the LLM's training data.

Data Cloud unified profiles

Combines CRM records, engagement history, and third-party signals into a single customer profile the agent can query in real-time. Enables highly contextualised responses grounded in current customer state.

Real-time CRM data via Actions

Get Actions retrieve live record data at the point of interaction — current account balance, latest case status, active opportunities. Not cached or approximated.

Einstein Search for knowledge articles

Semantic search over your Salesforce Knowledge base. The agent finds relevant articles based on intent, not keyword match — enabling accurate policy and procedure responses.

MuleSoft for external system data

Retrieves live data from ERP, EHR, core banking, or any external system that MuleSoft connects to. Gives the agent a complete picture even when relevant data lives outside Salesforce.

Retrieval Augmented Generation (RAG)

For large, unstructured knowledge bases, RAG retrieves the most relevant documents and passes them as context to the LLM — enabling accurate responses without training the LLM on proprietary data.

How long does it take to build an Agentforce agent?

Build time is the question every buyer asks and every vendor answers differently. Here is the honest answer based on our experience across multiple production deployments.

Single use case pilot2–3 weeks

One Topic, 3–5 Actions, defined knowledge base scope. Suitable for Service Cloud Tier 1 deflection, SDR qualification, or a focused internal use case. This is the right starting point for any organisation.

Multi-use case deployment6–12 weeks

Multiple Topics across one or more Clouds. Includes custom Action development, Data Cloud setup, knowledge base configuration, and full UAT. The upper end of this range applies to deployments requiring MuleSoft integration or regulated industry compliance configuration.

What determines build speed: Data readiness (the largest variable — clean, current CRM data and knowledge articles are a prerequisite), org complexity (the more custom configuration already in the org, the more integration work is needed), and integration requirements (external APIs and MuleSoft add weeks). Teams that have done the scoping work before build starts consistently hit the lower end of these ranges. Teams that scope and build simultaneously consistently hit the upper end.

Ready to deploy Agentforce in your org?

We run structured technical scoping sessions that translate your use case into a specific Topics, Actions, and Instructions design — before you touch Agent Builder.

Frequently asked questions

What is the difference between Agentforce and a chatbot?

Traditional chatbots follow decision trees — predefined if-this-then-that logic. If the user says something the chatbot was not programmed for, it either escalates or gives an irrelevant response. Agentforce uses the Atlas Reasoning Engine to reason about user intent dynamically — it reads context, plans multi-step responses, executes actions (updating records, calling APIs, sending emails), and determines its own next step based on the outcome. It can handle novel situations it was not explicitly programmed for, within its defined Topic scope.

What is the Atlas Reasoning Engine?

Atlas is Agentforce's core AI reasoning layer. It runs a four-phase loop on every interaction: Observe (read the conversation and load customer context), Plan (determine which Topic applies and which Actions are needed), Act (execute those Actions — updating records, calling APIs, triggering Flows), and Reflect (evaluate whether the outcome was successful and determine if further steps or escalation are needed). This loop runs continuously throughout a conversation, not just at the start.

What is the Einstein Trust Layer?

The Einstein Trust Layer is the security and governance perimeter around all Agentforce AI operations. It does five things: prevents prompt injection (users cannot manipulate the agent by embedding instructions in their messages), filters PII from data sent to LLM APIs (keeping sensitive data within the Salesforce trust boundary), enforces zero data retention at the LLM level (Salesforce's LLM provider does not store your data), generates an immutable audit trail of every agent action, and blocks outputs that violate configured compliance rules. It is the reason enterprises can deploy Agentforce in regulated industries.

How does Agentforce access CRM data?

Agentforce accesses CRM data through Actions. A Get Account Action queries the Account object. A Get Case History Action retrieves related cases. These Actions are configured with specific field permissions — the agent can only access fields it is explicitly granted access to, determined by the Agent User permission set in your Salesforce org. Data Cloud provides an additional grounding layer, giving the agent access to unified profiles that combine CRM data with external signals.

Can Agentforce take actions in external systems?

Yes. Agentforce can connect to external systems through several mechanisms: HTTP callout Actions (via Apex) connect to REST APIs directly — suitable for simpler integrations. MuleSoft-backed Actions provide enterprise-grade integration with complex transformation and governance. MCP server integrations (available in Agentforce 3+) allow connection to any MCP-compatible external tool. Examples include updating ERP inventory, retrieving EHR patient data, or querying a logistics tracking API — all within a single agent interaction.

What are Agentforce Topics and Actions?

Topics define what an agent is responsible for — its 'job description'. Each Topic specifies the scope of queries the agent handles, the instructions for how to handle them, and which Actions the agent can use within that Topic. Actions define what the agent can do — the 'tools' available to it. Action types include Flow-based actions (update records, send emails), Apex actions (custom business logic), API callout actions (external REST APIs), and Prompt actions (LLM-based text generation). An agent has one or more Topics, and each Topic grants access to a specific set of Actions.

Does Agentforce require Data Cloud?

Not strictly, but it is recommended for production-grade deployments. Without Data Cloud, agents are grounded only in data available in the immediate Salesforce record context. With Data Cloud, agents access unified customer profiles that combine CRM data, engagement history, and external signals — enabling significantly better context and higher resolution rates. Many organisations already have Data Cloud; if not, the $108,000/year list price needs to be weighed against the improvement in agent accuracy.

Can Agentforce be wrong? How do you handle hallucinations?

Agentforce can produce incorrect outputs, particularly when knowledge base data is stale, Action results are ambiguous, or the agent is given conflicting instructions. Hallucination risk is mitigated through three mechanisms: Data grounding (agents reason over verified CRM data and structured knowledge articles, not free-form web content), Einstein Trust Layer guardrails (hard stops on categories of output the agent must never produce), and Human-in-the-loop escalation (for any action above a defined risk threshold, the agent requires human approval before executing). Agents should never be deployed in production without defined escalation paths for their failure modes.

Understand how Agentforce will work in your org.

Talk to our team. We will walk through the Atlas Reasoning Engine, Topics and Actions design, and Einstein Trust Layer configuration for your specific use case — not a generic demo.