How Does Salesforce Agentforce Work? Subagents, Reasoning, Actions and Data Explained

How Does Agentforce Work, in One Picture?

An Agentforce agent needs three things to get work done: data, reasoning and actions. The reasoning engine plans what to do. Actions do the work in your org. Data 360 and your Salesforce records supply the facts. Around them, the Einstein Trust Layer and the agent's own permissions limit what it can see and say. Each layer below is something you configure.

Source: Salesforce's How Agentforce Works page and its guide to reasoning, subagents, instructions and actions.

What Are the Building Blocks of an Agentforce Agent?

Every agent is made of subagents, instructions and actions, plus the variables, filters and channels around them. Subagents define the jobs the agent can do. Instructions tell it how to do each job. Actions are the tools it uses. Salesforce describes these three as the levers you control: change them, and you change the prompts the reasoning engine works from.

The naming changed in April 2026. Salesforce now calls topics subagents, the Topic Selector the Agent Router, and a Connected Agent a Connected Subagent. Nothing works differently. You will still see "topics" in older documentation, and in screenshots like the one below from the earlier builder.

The classification description matters more than most teams expect. When a message arrives, the Agent Router looks only at each subagent's name and classification description to choose one. Two subagents with overlapping descriptions are the most common reason an agent picks the wrong job.

Salesforce's Agentforce considerations set some practical limits worth designing around:

• No more than 10 subagents per agent and 10 actions per subagent, and up to 100 agents per org. Einstein Bots count towards that limit.
• Actions time out after 60 seconds and reasoning requests after 30 seconds, so slow integrations need care.
• Agents handle one intent per message, and subagent and action instructions are supported in English only.
• Agents are available in Enterprise, Performance, Unlimited and Developer Editions, not in Government Cloud.

What Happens Inside the Atlas Reasoning Engine?

The reasoning engine runs a loop: classify the request, load the matching subagent, let the LLM decide the next step, run actions until it has what it needs, then check that the answer is grounded before sending it. If the answer fails that check, the agent tries again. If it still cannot produce a grounded answer, it sends a standard message saying it can't help, rather than guessing.

Salesforce documents eight steps. We have put them in plain terms:

This loop explains most agent behaviour. An agent that "ignores" an instruction usually had the instruction in the wrong subagent. An agent that picks the wrong action usually had two actions with similar names or descriptions, because the engine chooses actions from their names, descriptions and inputs. Salesforce introduced this layer as the Atlas Reasoning Engine; current documentation simply calls it the reasoning engine. Agent Script, announced with Agentforce 360 in October 2025, gives you direct control over it, as the next section shows.

How Does Agent Script Make Agents Predictable?

Agent Script lets you decide which steps the LLM may reason about and which must always run the same way. It mixes natural-language instructions with programmatic logic, such as if/else conditions, variables and forced transitions between subagents. Business rules like "verify identity before any refund" then don't depend on how an LLM reads a sentence. Salesforce calls this hybrid reasoning.

The new Agentforce Builder, generally available since February 2026, offers three ways to write Agent Script:

• Chat with Agentforce: describe the behaviour, for example "if the order total is over $100, offer free shipping", and the builder turns it into subagents, actions and instructions.
• Canvas view: the script shown as readable blocks. Type / to add common patterns such as conditions and @ to reference subagents, actions and variables.
• Script view: edit the script directly, with syntax highlighting and validation. Developers can also pull the script into VS Code with Agentforce DX.

Syntax from Salesforce's Agent Script reference; see also Get Started with Agent Script. Our rule of thumb: anything you would put in a compliance policy belongs in logic, and anything you would put in a style guide belongs in prompt instructions.

What Can an Agentforce Action Do?

An action is anything your org can already automate, made callable by the agent. Salesforce supplies standard agent actions, such as answering questions from knowledge, and you add custom actions built on Flows, Apex, prompt templates, MuleSoft APIs or external services. Salesforce recommends checking for a standard action before building a custom one. Each action needs a clear name, instructions on when to use it, and defined inputs and outputs.

Source: the action-type table in Salesforce's Agentforce guide. Licence requirements change, so confirm them for your edition.

Prompt templates on their own are also useful outside agents. Salesforce describes them as single-turn and stateless, so they are the right tool for one-off jobs like summarising a case or rewording an email. Use an agent when the work needs several steps, choices between paths or actions in other systems. Agents can also be started from Flow or Apex through an invocable action, so an agent can run a step inside an existing automation.

How Does Agentforce Use Your Data to Answer Accurately?

Agentforce grounds each answer in your data at the moment of the question, using retrieval augmented generation (RAG). Structured data comes from Salesforce records through actions. Unstructured content, such as knowledge articles, uploaded files and websites, is indexed in Data 360 through the Agentforce Data Library. The model is not retrained on your data. It is handed the relevant facts each time.

The Agentforce Data Library does this in two stages, according to Salesforce's Data Library module:

Data 360 is not optional. Salesforce states that Data 360 must be provisioned and enabled for all Agentforce use, and that the Data Library and the Einstein Trust Layer don't work without it. Data 360 is the name Data Cloud has used since October 14, 2025. It also connects data that lives outside Salesforce, for example by bringing it in on a schedule, querying it in place without copying it (zero copy), or calling it live through an API action.

In practice, answer quality depends on content quality. If three knowledge articles disagree about your returns window, the agent can retrieve any of them. Cleaning up content is usually a bigger job than configuring the library. Our Agentforce data and knowledge integration work starts there.

What Can an Agentforce Agent Access, and How Is It Kept Safe?

An agent sees only what its user record allows, and its generative AI runs inside the Einstein Trust Layer. An employee agent runs as the signed-in user. A customer-facing Service agent runs as a dedicated agent user, created with minimal access, and you widen that access object by object, on the principle of least privilege. Third-party models work under zero data retention agreements, so they don't keep your prompts.

For Agentforce Service agents, Salesforce's agent user documentation sets out how this works:

• The agent user. Anonymous and unverified conversations run as the "EinsteinServiceAgent User" with the Einstein Agent User profile. Its profile, permission sets, field-level security and sharing rules decide what the agent can read or change.
• Secure by default. The user gets the Agentforce Service Agent Secure Base permission set and an agent-specific permission set. You add object access for every object the agent's Flows, Apex or prompt templates touch.
• Logged-in users. On a site where the customer is signed in, the agent runs as that customer, with that customer's own access.
• Getting it wrong cuts both ways. Too little access and the agent can't answer. Too much and it can expose data a customer should never see.

Salesforce lists the Trust Layer's protections for agents as grounding in CRM data, masking of sensitive data, toxicity detection, an audit trail with feedback, and zero data retention with third-party models. It also notes that some Trust Layer features apply only to the agent's final response, so don't treat masking as a replacement for tight agent-user access. Agentforce guardrails combine your own rules with protections managed by Salesforce, to keep agents on topic and limit hallucination and bias. Twopir's Agentforce governance and security service reviews agent-user access and guardrails before go-live.

Where Do Agentforce Agents Run, and How Do They Hand Off to People?

You build an agent once and deploy it to several channels without rebuilding the logic for each. Customer-facing agents run in web chat, in-app messaging, voice and mobile apps. Employee agents run inside Salesforce and Slack. Developers can call any agent through the Agent API, or from a Flow or Apex. Escalation to a human service rep carries the full conversation with it.

Source: Salesforce's Agentforce APIs and SDKs overview. Handoff is where many first agents fail. Decide in advance which requests always go to a person, which queue receives them, and what the person sees when the case arrives.

How Do You Test and Monitor an Agentforce Agent?

Test manually in the builder's conversation preview, then in batches in the Agentforce Testing Center, and monitor every production session in Agentforce Observability. Batch tests pair sample questions (utterances) with the subagent, action and answer you expect. They run in parallel in a sandbox, and AI can generate hundreds of test conversations. After go-live, session traces show each decision the agent made.

Sources: Trailhead's agent testing module and Salesforce's July 2026 Observability update. That update made out-of-the-box observability unmetered for every Agentforce customer, so it no longer draws on Flex Credits. Building new dashboards or bringing in external data is still metered. Session outcomes such as deflection are now judged by an LLM that reviews the whole session, using a prompt you can inspect and edit. See our Agentforce testing and deployment service for how we run this before launch.

How Is Agentforce Priced?

Agentforce is priced either by consumption or per user. With Flex Credits, each action an agent runs draws from a prepaid pool: 20 credits for a standard action and 30 for a voice action, at a list price of US$500 per 100,000 credits. That makes a standard action about US$0.10. Customer-facing agents can also be priced per conversation, and employee use can be bought per user.

Salesforce's own worked example: a self-service agent that uses two actions per "where is my order?" request (verify the customer, then fetch the order) and handles 20 requests a day uses 24,000 credits a month, about US$120. A case-management example with 100 users and three actions per case comes to about US$1,800 a month. Sources: Agentforce pricing and the 2026 editions announcement. Contract prices vary, and Data 360 consumption and implementation are extra.

The cost driver to watch is the number of actions per request, not the number of conversations. A badly scoped subagent that calls four actions where one would do costs four times as much per answer.

What Agentforce Is Not: Four Common Misunderstandings

Agentforce is an AI agent platform, not a routing engine, a chatbot script tree or a system that teaches itself. Our February 2025 version of this article described it partly as call-centre routing and dashboards. Those features belong to Service Cloud's Omni-Channel, which agents can hand work to, but they are not how Agentforce works.

How Do You Build Your First Agentforce Agent?

Start with one narrow, high-volume job, map it before you build, and test it in a sandbox against real questions. A first agent that handles order-status questions or qualifies inbound leads well teaches you more than a broad agent that handles ten things badly. Most of the effort goes into the data, the permissions and the handoff rules, not into the builder.

These are the gaps we see most often when a company wants to switch on Agentforce:

Our Agentforce readiness assessment checks these in two to four weeks and ends with a costed shortlist of use cases. Sometimes the recommendation is "not yet". When you are ready to build, our AI agents for Salesforce team designs, builds and governs the agent. In one published project, we connected Salesforce, OpenAI GPT and AWS Textract for a US legal tech platform so that every inbound email and attachment becomes a Salesforce case note. That removed more than 15 hours a week of manual case-note work. Results depend on each company's data and process, so treat this as an example of the pattern, not a benchmark.

The Bottom Line

Agentforce works the same way whatever the job: a reasoning loop chooses a subagent, runs your actions against your data, and checks its answer before replying. The parts you control are the ones that decide whether it works. That means clear subagents, precise instructions, well-named actions, clean content and tight permissions.

1. 1

   Learn the loop: classify, load the subagent, decide, act, repeat, check grounding, respond.

2. 2

   Write distinct classification descriptions, and put business rules in Agent Script logic rather than prose.

3. 3

   Reuse your Flows and Apex as actions, and give each one a clear name and instructions.

4. 4

   Plan for Data 360, clean knowledge content and a least-privilege agent user.

5. 5

   Count actions per request to forecast cost, test in a sandbox, and monitor every session after launch.

Frequently Asked Questions