Einstein Trust Layer: What Secure Agentforce AI Agent?

**Key takeaways:**

Prompt validation, trusted data grounding, and response validation.
Protects data with AI privacy, prompt injection protection, and zero data retention.
Enables secure, governed AI agents using trusted Salesforce data.

What if an Agentforce AI agent has access to your entire CRM?
It finds customer records, updates opportunities, triggers workflows, and even makes business decisions in seconds. But it also raises a much bigger question: what prevents it from leaking sensitive data, answering malicious prompts, or taking actions it shouldn’t?
This is a challenge that all enterprises face when they adopt AI agents. Intelligence is not enough. AI also needs security, governance, and trust built into every interaction.” This is why Salesforce Agentforce is not simply built on large language models. It leverages the Einstein Trust Layer, an AI Trust Layer designed to protect data, enforce policies, and ensure every AI response is protected before it reaches a user.
In this guide, we’ll deconstruct how the Einstein Trust Layer works behind the scenes, how it protects Agentforce AI Agents, and why it’s one of the most critical parts of enterprise AI on Salesforce.

Why AI Agents Need a Trust Layer

An Agentforce AI Agent can access CRM data, work with APIs, run workflows, and support key business processes – all from one prompt. But with that level of access comes an equally important responsibility: making sure every interaction is secure, every response is reliable, and every action is in line with your organization’s security policies.

Without these safeguards, organizations risk leaking sensitive data, AI hallucinations, unauthorized actions, and compliance violations.

Risk	Why It Matters
Sensitive Data Exposure	AI agents may expose confidential customer or business data if access controls aren't enforced, putting AI Data Privacy at risk.
Hallucinations	AI can generate inaccurate or misleading responses, leading to poor decisions and reduced trust.
Unauthorized Actions	AI agents may perform actions beyond a user's permissions without proper security controls.
Compliance Concerns	AI interactions must meet regulatory, privacy, and organizational governance requirements.

What Is the Einstein Trust Layer?

The Einstein Trust Layer is the secure AI framework that powers trusted generative AI experiences across Salesforce Agentforce. It enables organizations to secure AI Data Privacy, implement user permissions, and deploy governance controls through every AI interaction.

Instead of prompts being directly sent to an LLM, the AI Trust Layer adds security controls at the data retrieval stage, during AI processing, and before the response is delivered. This helps Agentforce AI Agents access only authorized information, with secure and reliable response.

How Einstein Trust Layer Protects Every AI Interaction

AI Agent receives a request, it goes through a secure workflow to return a response. The Einstein Trust Layer adds controls for security, privacy, and governance at every step to enable securing enterprise data and delivering trusted AI responses.

Stage 1: Prompt Validation

Once the user submits the prompt, the security process starts, and before forwarding the user’s query to the LLM, it passes it to the Einstein Trust Layer to evaluate the request to ensure it complies with organizational security policies.In this stage of the evaluation process:

Verifies the user's authority and access control.
Evaluates the incoming request before AI processing.
Applies Prompt Injection Protection to detect malicious or manipulated prompts.
Prevents unauthorized requests from progressing further.

The first validation rule is to only send trusted and authorized requests to the AI Model.

Stage 2: Grounding trusted data

After the first level of validation, Salesforce Agentforce retrieves only the business data required to answer the query. It does not rely solely on the LLM's knowledge; the Einstein Trust Layer grounds the request using trusted Salesforce data.

It includes:

CRM records
Data Cloud profiles
Knowledge articles
Other authorized enterprise data

By using Secure Data Retrieval, Agentforce AI Agents receive the business context needed to generate more accurate responses while supporting Hallucination Prevention.

Grounding Source	Purpose
Salesforce CRM	Customer and business records
Data Cloud	Unified customer profiles
Knowledge Base	Product and support content
Enterprise Data	Additional business context

Stage 3: Sensitive Data Protection

The Einstein Trust Layer analyzes the grounded prompt for personally identifiable information (PII) before the prompt is sent through the LLM gateway. The tracking process happens through field metadata, pattern matching, and entity detection by machine learning algorithms.

FiGHT uses placeholder tokens such as PERSON_0 in the place of any identified PII, thus ensuring that the LLM works with the confidential information in its masked form.

Why it matters: The AI receives only the information needed to generate a response—nothing more.

Stage 4: Secure LLM Processing

After validating, grounding, and preparing the prompt, it enters the LLM Gateway for model inference. The gateway establishes a secure connection between Salesforce Agentforce and the supported LLM vendors in a manner that preserves the security features of the Trust Layer.

With Zero Data Retention, prompt payloads are only processed at the stage of inference. They are neither stored in the system, nor utilized for training, nor retained by the model vendor once the response is produced.

Step 5: Verify the Answer

After inference is done, the LLM generates a response, which is run through the Einstein Trust Layer to validate it against the policy, and it is returned to the user. Salesforce reviews the response to help make sure that it meets enterprise security and governance requirements.

The checks for validation are:

Safety Classification: Identifies toxic, harmful, or dangerous content.
Policy Compliance: Verifies that the response is consistent with the organization’s AI policies.
Grounding Validation: Validates that the response is grounded in the retrieved Salesforce context and not based on unsupported model assumptions, helping to prevent Hallucination.
Response Filtering: Filters or blocks content that fails to meet security or compliance requirements.

This means only validated, policy-compliant responses are returned.

Step 6: Governance & Audit

The response is then logged by the Einstein Trust Layer and dispatched for monitoring, governance, and compliance. Gives organizations visibility into how Agentforce AI Agents are being used across the enterprise.

Audit features include:

Prompt Logging: Logs AI prompts for traceability and investigation.
Response Logging: Logs responses created for review of response and quality analysis.
AI Feedback: Collects feedback from users to enhance the accuracy of the AI for subsequent use.
Regulatory Compliance Monitoring: Internal Governance Documentation. We log all AI interactions to track usage, troubleshoot issues, and manage enterprise governance.

Key Security Capabilities of Einstein Trust Layer

The Einstein Trust Layer combines multiple security and privacy capabilities to help Salesforce Agentforce deliver trusted generative AI experiences. Together, these capabilities protect enterprise data throughout the AI request lifecycle.

Capability	Description
Secure Data Retrieval	Retrieves only the Salesforce data the user is authorized to access, preserving role-based access controls and field-level security during grounding.
Dynamic Grounding	Enriches the prompt with relevant CRM and Data Cloud context before inference, improving response quality and reducing hallucinations.
Prompt Defence	Applies system instructions and safeguards to help defend against prompt injection and reduce unintended or harmful outputs.
Data Masking	Detects and masks sensitive information before sending prompts to supported LLMs. Note: For Agentforce, data masking is currently disabled to preserve agent accuracy.
Zero Data Retention	Ensures supported third-party LLM providers don't retain prompts, responses, or customer data after inference or use them for model training.
Toxicity Detection	Uses machine learning models to evaluate prompts and responses for harmful content and assigns toxicity scores for monitoring.
Audit Trail	Records prompts, responses, trust signals, and feedback in Data 360 to support governance, monitoring, and compliance.

Best Practices for Building Secure Agentforce AI Agents

Securing Agentforce AI Agents to get them up and running is more than just turning on the Einstein Trust Layer. Salesforce suggests that customers use the platform’s built-in security controls in conjunction with sound identity, access, and runtime governance.

Configure a Dedicated Running User

Every Agentforce AI Agent runs as a running user. Do not use an administrator profile, but a dedicated user with the minimum permissions required for the agent's tasks. This means that all actions are performed in accordance with the Salesforce access control model.

Apply the Principle of Least Privilege

Ensure that the agent has visibility only to the objects, fields, records, Apex classes, Flows, and Prompt Templates it needs. Limiting the scope of permissions helps limit damage caused by misconfiguration and unauthorized access.

Design Secure Actions

Actions are the things that an agent can do. Validate user input, minimize the scope of action, and expose only the business operations that the agent needs. Add authentication or approval steps for the agent to take high-impact actions for sensitive workflows.

Improve agent instructions and guardrails

Define clear instructions, topics, and boundaries of actions to make sure the agent will always follow the intended business process. Clear directions help students to follow instructions more closely and result in fewer off-topic answers.

Monitor The Runtime Behavior

Review audit logs, activity prompts, runtime guardrails, and user feedback regularly. With continuous monitoring, you can catch unexpected behavior, verify the quality of your grounding, and refine your agent’s configuration over time.

Validate Before Production

Before you deploy your agents to production, test prompts, validate expected behaviors, and test edge cases using the Agentforce Testing Center. Testing helps uncover security, grounding, and instruction problems early in the development life cycle.

Conclusion

The Einstein Trust Layer is more than a security feature; it's the foundation that enables Salesforce Agentforce to deliver trusted AI experiences. By combining secure data retrieval, AI Data Privacy, Prompt Injection Protection, and Zero Data Retention, it helps organizations build Secure AI Agents without compromising security or compliance.

Whether you're exploring or implementing Agentforce Service, working with an experienced Salesforce Consultant can help you build AI agents that are secure, scalable, and aligned with Salesforce best practices.

Frequently Asked Questions

The Einstein Trust Layer reduces hallucinations by grounding prompts with trusted Salesforce data before inference. Instead of relying only on the LLM's pretrained knowledge, the model receives relevant CRM or Data Cloud context, resulting in more accurate and context-aware responses.
Prompt engineering defines how an AI agent should behave, while grounding provides what business information the model should use. The Einstein Trust Layer combines both to generate responses based on trusted Salesforce data.
Yes. Communication between Salesforce and supported LLM providers is secured using encrypted transport protocols. Combined with Zero Data Retention, this helps protect enterprise data during AI inference.
Sending complete CRM records would increase unnecessary data exposure. Instead, the Einstein Trust Layer constructs a grounded prompt using only the authorized business context required to answer the request, helping protect AI Data Privacy.
Every AI request follows a structured processing pipeline. The Einstein Trust Layer first validates the incoming prompt and applies permission-aware access checks. It then retrieves relevant business context through Dynamic Grounding, constructs a grounded prompt, and routes it to the selected model through the LLM Gateway. After inference, the generated response passes through policy validation before it's returned to the user, while audit metadata is recorded for governance.

How Einstein Trust Layer Secures Agentforce AI Agents

Why AI Agents Need a Trust Layer

What Is the Einstein Trust Layer?