Agentforce compliance means holding AI agents to the same controls as the people and code they work alongside.
Under SOX, an agent that can touch financial data needs change management, access control and monitoring. HIPAA asks for access and audit controls, plus a Business Associate Addendum (BAA) that covers the agent's services.
Below, we map AI agent compliance in Salesforce to what agents do in your orgs under both frameworks, and list the evidence your auditors will want.
Why do AI agents change the compliance picture?
An agent that only answered questions would be easy to govern. Salesforce Agentforce agents also run actions, and each agent action in a session trace is an Apex class, a flow or an MCP call.
That means autonomous AI agents can read and change the same customer data and CRM data your SOX and HIPAA controls protect.
Who an agent acts as depends on its type. A service agent gets its own agent user.
An employee agent borrows the identity of whoever is logged in, including that person's permissions and sharing. So it's only as tightly controlled as the user record behind it.
Per Salesforce, agents respect standard access controls such as licenses, permissions, field-level security and sharing settings.
That's good news for data access, and it's also the catch. Give an agent a broad profile or loose sharing rules and it gets broad record access to your Salesforce data.
Under Salesforce's shared responsibility model for Agentforce, least privilege, action limits and activity audits sit with you. Our post on agent-aware governance picks up the governance side.
Risk controls matter commercially too. Gartner predicts that more than 40% of agentic AI projects will be scrapped by the end of 2027, citing inadequate risk controls as one cause.
Which SOX controls apply to Agentforce agents?
SOX Section 404 requires an annual management assessment of internal control over financial reporting. The company's auditor also reports on it unless an exemption applies.
Nowhere does SOX name tools, so the real question is what an agent can touch. If it can create or edit records that feed revenue or other financial reporting, treat it as in scope.
PCAOB auditing standard AS 2201 describes general controls over program changes, access to programs and computer operations. Agents fit all three.
Take a service agent that can issue credit memos. If an admin changes its instruction from "credits up to $50" to "use your judgment on credits," that's a program change to a financial process, with no code involved.
SOX control areas mapped to agent behavior
Each general control area applies to an Agentforce agent as shown below. In the last column is the evidence an auditor can test.
Change management for agent versions
Once a version is committed, you can't edit that agent version; you create a new one. And Salesforce lets just one version run at any moment.
Auditors like that, because every behavior change has a version number attached.
Write down which version went live, who approved it and who switched it on. For the release mechanics (version control, sandbox testing, approvals, rollback), see our guide to deploying Agentforce agents.
Access and segregation of duties
By design, the agent user starts with minimal access, and Salesforce's advice is to add permissions on a least-privilege basis. Grant only what its actions touch, object by object and field by field.
Our post on Agentforce security practices covers the setup.
Whoever builds an agent shouldn't also approve and activate it, because segregation of duties doesn't stop at code.
Flosum's SOX compliance solution covers approval tracking and segregation of duties across releases.
Setup Audit Trail logs permission set changes with the date and who made them, but only keeps 180 days. If your audit period runs longer, export it.
The rest of a SOX program is in our roundup of SOX compliance tools.
Monitoring what agents do in production
Session Tracing records each session's turns, reasoning, actions, errors and final responses in Data 360.
Field History Tracking shows what changed and who changed it. Event Monitoring picks up the Apex, flow and API events an agent sets off.
To walk one record change back to the session that caused it, use our post on the Agentforce audit trail.
What does the Einstein Trust Layer cover for compliance?
Agentforce runs on the Einstein Trust Layer, Salesforce's security architecture for generative AI on the Salesforce platform. Compliance teams should know what each piece does, because none of them replaces your own controls.
Salesforce lists five services:
- Zero data retention: third-party large language models don't store the data sent to them or train on it.
- Dynamic grounding with secure data retrieval, which builds answers from trusted company data, your knowledge base or other sources you configure
- Prompt defense: system policies plus prompt injection detection
- Toxicity detection, which flags harmful responses (it doesn't block them)
- Audit and Feedback logging of prompts, responses and trust signals in Data 360 (formerly Data Cloud)
Read the zero data retention line closely. That same Help page adds that your use of other features, including agents, may result in data storage, and points you to your Salesforce account executive.
Put that question on your vendor review list.
Prompt injection is a compliance risk too
OWASP ranks prompt injection as the top risk (LLM01) in its Top 10 for LLM applications. In the indirect version, the attacker hides instructions in data the agent reads, such as an email body or a web form.
Noma Security's 2025 ForcedLeak research is the Agentforce example. Hidden text in a Web-to-Lead submission could get an agent to send CRM data to a domain that had lapsed but was still allowlisted.
Salesforce started enforcing Trusted URLs for Agentforce in September 2025.
For a SOX or HIPAA org, that's a data exposure path as well as a security bug.
Salesforce's shared responsibility guidance calls for a human in the loop on custom actions. Put a person's approval in front of any action that changes financial records or sends data outside Salesforce.
Which HIPAA safeguards apply to Agentforce agents?
The HIPAA Security Rule's technical safeguards cover access control, audit controls, integrity, person or entity authentication, and transmission security. Its administrative safeguards add a required review of system activity, such as audit logs and access reports.
Then there's the Privacy Rule's minimum necessary standard, which asks you to limit protected health information (PHI) to what the purpose needs. With agents, that's a permissions question: which records and fields can its user reach?
Start with the BAA
Salesforce's BAA restrictions list the services it covers. Today that list includes Agentforce Service Agent, Agentforce Assistant, Agentforce Voice, Agentforce SDR, Agentforce Sales Coach, Prompt Builder and Data 360 (formerly Data Cloud).
Check that every agent product you use is a covered service before PHI is involved.
You also can't use these Einstein services as a substitute for medical advice, as a medical device, or to infer a person's health condition. For Agentforce Services and Prompt Builder, the page says that, to the extent within your control, you must enable, maintain and use Data Masking in the Einstein Trust Layer.
Data masking: two Salesforce pages disagree
According to Salesforce Help, agents run with Trust Layer masking switched off, a choice made for performance and accuracy. External LLM providers still don't store or train on the data agents access, under Salesforce's zero data retention policy.
Ask your Salesforce account team how the BAA's masking term applies to your agents. Until you have an answer, limit PHI exposure through the agent user's access, not masking.
HIPAA safeguards mapped to agent behavior
Here are the main safeguards lined up against Agentforce. Section numbers refer to 45 CFR Part 164.
Protect the logs and the test data
Your audit trail can hold PHI too. Stored audit and feedback data may contain personal, health and payment card details, Salesforce warns.
Treat access to that data space like access to PHI itself.
Testing Center belongs in a sandbox, Salesforce says, since a test run can modify CRM data. If that sandbox holds copied production records, mask the data first.
Required Security Rule documentation has to be kept for six years from its creation or the date it was last in effect.
If you keep agent evidence on that clock, export it. Setup Audit Trail keeps 180 days and field history up to 18 months unless you use Field Audit Trail.
Our HIPAA guide for Salesforce covers the rest of the org.
What about the EU AI Act and other regulations?
SOX and HIPAA aren't the only rules in play. The EU AI Act entered into force on August 1, 2024 and became applicable on August 2, 2026, with some exceptions.
Its obligations for high-risk AI systems, which include activity logging for traceability and human oversight, start on December 2, 2027 for the listed high-risk use cases.
You don't need a separate control set for each regulation. Least-privilege access, versioned changes, session logs and documented reviews give compliance teams evidence they can reuse across frameworks.
A compliance checklist for regulated Agentforce teams
Run through this before an agent goes live in a SOX or HIPAA org. It's our recommendation, pulled from the controls above.
- Scope each agent: what it reads, what it changes, where it sits (Sales Cloud, Service Cloud or elsewhere), and whether financial data or PHI is involved.
- If PHI is involved, confirm the agent product is a covered service on the BAA.
- Least-privilege permission sets for the agent user. For employee agents, review the people using them too, because the agent inherits their access.
- Instruction edits get the same review, approval and versioning as code.
- Three different people build, approve and activate.
- Human approval on actions that change financial records or send data out. Keep the Trusted URLs list short.
- Confirm in Setup that Session Tracing and Audit and Feedback are on.
- Lock down the Data 360 space that holds the logs.
- On a schedule, sample sessions and agent user access, and record who reviewed what, and when.
- Export anything your audit period needs that Salesforce won't keep.
- Masked data only in agent test sandboxes.
Our audit trail compliance guide shows where this evidence sits next to the rest of your Salesforce records.
This guide is general information, not legal advice. Check your obligations with your compliance team and auditors.
Where does Flosum fit?
For release control, Flosum DevOps puts agent metadata through version control, approval gates, testing and an audit trail, alongside every other change to your orgs. On top of that, Flosum's SOX compliance solution adds approval tracking, deployment governance and audit-ready change history.
Flosum Trust Center monitors configuration changes, user activity and permission updates across your environments. It supports SOX and internal governance with audit trails, activity tracking and compliance reporting.
FAQs
Running Agentforce in a SOX or HIPAA org? Book a personalized demo to see how Flosum keeps agent changes, access and evidence audit-ready.
Thank you for subscribing
