Written by: Melat Tadesse
Published:
Updated:
A Salesforce platform architect finishes configuring an Agentforce agent. Subagents are scoped. Actions are restricted. Escalation rules are set. The rollout is signed off as brand safe.
Then the agent answers a customer in its own words, inside every boundary it was given. The sentence is on subject, within permissions, and clear of anything a safety filter would catch. It is also off the brand's written standard, and nothing in the stack noticed. The configuration governed what the agent could reach. It never read what the agent said.
For a bank on Financial Services Cloud, that is the moment the review process was built to cover and does not.
What Agentforce Guardrails Are
Agentforce guardrails are the controls that set an agent's operational boundaries. Salesforce Trailhead describes them as controls that "define the operational boundaries for each agent, outlining what it can and can't do." The Salesforce Architects guidance is more precise. A guardrail there "acts as a safety layer that can intercept prompts, validate the agent's proposed actions, and filter its final response to prevent harmful content, enforce business rules, and ensure the agent operates within its designated scope."
In practice the layer is assembled from several parts. Subagents, the component Salesforce formerly called topics, bound the subject matter an agent will take on. Action permissions bound what it can execute. Data access and field-level security, which Salesforce's shared responsibility guidance assigns to the customer, bound what it can retrieve. Escalation rules route a conversation to a person, and the same Trailhead unit counts that as a guardrail.
The Einstein Trust Layer sits underneath all of it. It grounds responses in CRM data and holds zero data retention with third-party model providers. It scores generations for toxicity by safety category, and it keeps an audit trail.
Every clause of that definition limits what the agent may do, or the kind of thing it may say. None of them describes a judgment on whether a permitted sentence met the standard the brand wrote down. In Salesforce's architecture, no part of that layer answers it.
Why It Matters Now
Salesforce's shared responsibility guidance for Agentforce, published on 25 February 2026, exists to tell each party what it owns. The brand standard is not in it. An organization has already been held to what its chatbot said with a published standard in place.
In Moffatt v. Air Canada, 2024 BCCRT 149, decided on 14 February 2024, the British Columbia Civil Resolution Tribunal held an airline to what its chatbot told a customer. The chatbot had contradicted a policy the airline had already published. The tribunal did not accept the argument that the chatbot was a separate legal entity answerable for its own words.
That is one decision of one tribunal. It is not a court judgment, and it is not binding precedent. What makes it load-bearing here is narrower than liability. The standard existed. It was written down, published, and reachable. The answer contradicted it, and the organization carried that answer.
An Agentforce agent puts the same question on every reply, and it can reach a customer channel without any step in the configured path reading the finished sentence against the brand's written standard. A brand's voice, its approved claims, and its published terms can all exist in writing while every sentence ships unmeasured against them.
Salesforce's Own Architecture Splits the Decision
The strongest evidence here is not an outside critique of the platform. It is Salesforce's own documentation, read across two pages.
Guardrails and Prompt Templates Are Different Components
The Salesforce Architects agentic patterns guidance defines a guardrail as a safety layer that intercepts prompts, validates the agent's proposed actions, and filters its final response "to prevent harmful content, enforce business rules, and ensure the agent operates within its designated scope." In the same document, it describes prompt templates as the component that lets agents generate "contextual, on-brand content."
The middle clause is the one to take seriously. A brand standard is a kind of business rule, so it looks like it should already be covered. It is not, because a business rule a guardrail can enforce is one the system can check: a permission, a scope boundary, a prohibited action, a required escalation. "This sentence meets our written standard" is not of that kind.
On-brand output is therefore located in a different architectural component from the guardrail layer. That is this article's reading of the two passages, not a statement Salesforce makes. The vendor documents where on-brand content is authored. It does not draw the consequence.
A prompt template shapes the sentence while it is being written. A guardrail checks the finished sentence against harm, scope, and the rules a system can check. Neither one measures it against the brand's own standard.
The Shared Responsibility Model Allocates the Question to Neither Party
Salesforce published its Agentforce security and shared responsibility guidance on 25 February 2026. It allocates the primary security responsibilities between the two parties, item by item.
Salesforce owns platform security, the Einstein Trust Layer, detection of broad threats such as toxicity and prompt injection, and audit logging. The customer owns least privilege, permissions, and field-level security. It also owns "Building secure Agent Guardrails (restricting topics and actions)," monitoring, data hygiene, event logs, and human-in-the-loop review for custom actions.
Output quality against a brand's own written standard appears on neither side.
That is an absence, and it should be read as one. On this article's reading, the document allocates the question to neither party. Salesforce has not said that nobody owns it. The distinction is worth holding, because the two are easy to confuse and only one of them is defensible.
Notice how far the customer's side already reaches. Human-in-the-loop review for custom actions, and data hygiene, are not security controls. They are duties for the quality of what the agent does. The allocation crosses into operational quality and then stops one step short of the output itself. On this article's reading, that is where the brand standard falls.
Salesforce Names the Standard and Names the Check
Salesforce documents toxicity scoring as a measure of "the level of potentially harmful language detected by the Einstein Trust Layer in large language model (LLM) responses," scored by safety category. On the categories the page lists, the scored dimension is harm, with no style, tone, or brand-fit measure beside it.
Salesforce is explicit about the remedy it recommends. Its Trust Layer developer guide advises that "we recommend that a human check each model response before sharing them with end users for the majority of use cases," and that external-facing responses should "align with your company's values, voice, and tone." Salesforce names the standard and names the check. What the documentation does not supply is a mechanism that performs it. Salesforce guidance elsewhere tells builders to "Create a Voice and Tone guide tailored specifically for your agents," and stops at the authoring.
A Representative Workflow
Consider a hypothetical but representative scenario. A bank's Financial Services Cloud implementation runs an Agentforce agent scoped to general account and product questions. Subagents are narrow. Actions are read-only lookups. Escalation fires on anything resembling advice.
Every setting does its job. The agent stays on subject, executes only approved actions, and escalates when it should. Toxicity scoring returns nothing of concern. The response is grounded, logged, and retained correctly.
The sentence still states a rate in terms the bank does not use with customers. Not a fabricated rate, but a current and correctly retrieved one, framed with a confidence and a comparison the bank has never approved. It is on subject, within permissions, accurate, and still not the answer the bank would have given. Nothing in that path measured it. Nothing held it. Nothing recorded a decision about it, because no decision was made.
The Counterargument: Guardrails Do Cover Tone
The clearest published counterargument says the opposite of all this. MarCloud Consulting argues that guardrails "can enforce AI-generated responses to align with predefined tone and language guidelines," and treats the real work as anticipating the guidelines.
Part of that is right, and it deserves saying plainly. Natural-language instructions genuinely do constrain what an agent says. A careful instruction set materially improves how a response reads. Teams that invest in one get better output than teams that do not.
The answer is a distinction rather than a denial. An instruction shapes generation. It does not adjudicate the sentence that generation produced. Enforcement would need something that scores the finished response against the standard, and on the categories Salesforce documents the Trust Layer scores for harm alone. On this article's reading, a vendor that recommends a human check on each response is not treating generation-time constraint as sufficient. If instructions settled the question, the vendor would not be recommending a reviewer.
Where the Decision Gets an Owner
LuxeDetect™ is AI Brand Integrity Infrastructure: the independent, deterministic brand-integrity release gate across the enterprise AI stack. It is designed to operate as a release-gate layer alongside Agentforce guardrails, not instead of them.
Salesforce's controls govern access, scope, and harm. LuxeDetect™ is designed for the layer those controls were never built to reach, which is the language itself at the moment before a customer sees it.
In the designed workflow, an in-scope output is routed through the brand-owned LF1000 Brand Benchmark and evaluated deterministically against the LuxeFactor™ methodology. The result carries a LuxeFactor™ Score and a LuxeFactor™ Range. Tiered actions follow from it: an output is approved, routed for human review, or intercepted at the release gate. Every evaluation is logged with its rationale, its reason codes, and the benchmark version it ran against.
LuxeDetect™ does not generate or rewrite the content it evaluates, and it does not configure subagents, actions, or data access. Reproducibility is the point. The same output, measured against the same benchmark version by the same rule, returns the same result.
The standard does not belong to the model, the platform or LuxeDetect™. It belongs to the brand. LuxeDetect™ turns that standard into something enforceable.
Agentforce Guardrails and the Brand-Standard Release Gate, Compared
Agentforce guardrails and a brand-standard release gate answer different questions, at different points in the same workflow.
What it governs. Guardrails: subagents, actions, data access and escalation. Release gate: the generated sentence itself.
When it acts. Guardrails: before and during the agent's turn. Release gate: at release, before the customer sees the output.
Core question. Guardrails: is the agent permitted to do this? Release gate: does this sentence meet the standard the brand wrote?
What it does not cover. Guardrails: whether a permitted sentence met the brand's standard. Release gate: data access, model performance, platform security.
Who owns it. Guardrails: Salesforce and the customer, per the shared responsibility guidance. Release gate: the brand, because the standard is the brand's own.
What it leaves behind. Guardrails: a transcript of what was said. Release gate: a logged evaluation with its rationale and benchmark version.
To apply this to a live deployment, work through the release-gate side of each comparison.
Write the standard down first. If a brand's voice, approved claims, and published terms live only inside prompt text, they are instructions to a generator. They do not exist as a reference that something can measure an answer against.
Then put three questions to each customer-facing agent.
- What reads the finished sentence before it sends?
- What record does that reading leave?
- Who is named as the owner of the decision?
If the answer to the first is a prompt template, the second is a transcript, and the third is unassigned unless someone was named for it. A transcript proves what was said. It does not prove the sentence met the standard. Nothing established that while the sentence could still be held. An architect cannot assign the owner, but those three answers are the record that makes the gap concrete enough to hand to whoever can. Ranking Agentforce use cases by what reaches the customer is the same exercise at portfolio scale, and it puts irreversible deployments at the top. Those are where this gap costs the most.
Frequently Asked Questions
What Are Agentforce Guardrails?
Agentforce guardrails are the controls that set what an agent can address and do: Agentforce subagents for subject matter, action permissions, data access and field-level security, and escalation rules, with the Einstein Trust Layer adding grounding, toxicity scoring, an audit trail, and zero data retention. They govern what the agent may reach, and the kind of thing it may say. They do not establish whether a given sentence met the brand's written standard.
Do Agentforce Guardrails Protect the Brand?
Agentforce guardrails protect access, scope, and data handling, and they score output for harm. They do not evaluate whether a permitted sentence matches a brand's approved voice, claims, or terms. On this article's reading of Salesforce's architecture guidance, the Salesforce AI guardrails it describes are a safety layer, and on-brand content sits with prompt templates instead.
Do Agentforce Guardrails Check Tone of Voice?
Agentforce guardrails do not check tone of voice as a scored dimension. The Einstein Trust Layer scores responses by safety category for potentially harmful language, and the documented categories carry no style or tone measure. Salesforce advises teams to write a voice and tone guide for their agents, which governs how a response is authored. It does not establish whether the finished response met it.
Who Is Responsible for What an Agentforce Agent Says?
Salesforce's shared responsibility guidance of 25 February 2026 divides duties between Salesforce and the customer. Output quality against the brand's written standard appears on neither side. In Moffatt v. Air Canada, 2024 BCCRT 149, the British Columbia Civil Resolution Tribunal held an airline to what its chatbot said. That is one tribunal decision rather than settled law, but it is where the exposure landed. So the organization answers for the sentence, while the documented allocation assigns that check to neither party.
Where This Leaves the Brand Standard
Agentforce guardrails are doing the job they were built to do. The brand standard is a separate decision, and the documented allocation gives it no owner at the moment of release. For how supervisory expectations reach the AI assistant without reaching the answer, read our guide to model risk management for AI assistants.
Request early access to LuxeDetect™ to give the brand standard an owner at release.
AI content risk is not solved after publication; it has to be controlled before release.