# Agentforce use cases, trust and agent permissions

*Platform Administrator Study Guide · Agentforce · Last updated September 26, 2026 · https://certifyforce.com/study-guide/platform-administrator/agentforce/agentforce-capabilities-use-cases-and-permissions*

Match a business need to the right Agentforce agent type or to deterministic automation, explain what the Einstein Trust Layer does, and troubleshoot agent access through the interacting user, the service agent user and the Manage AI Agents permission.

- Certification: Salesforce Platform Administrator
- Exam section: Agentforce
- Study guide: https://certifyforce.com/study-guide/platform-administrator

**Official exam objective:**

> Describe the capabilities and use cases of Agentforce (scenarios about use cases, when it's appropriate to use AI, security, troubleshooting agent permissions).

## What the exam expects

- Choose between an employee-facing agent and a customer-facing service agent from who the users are and which channel they use.
- Decide when a requirement suits generative AI and when it needs deterministic automation.
- Explain what the Einstein Trust Layer protects: zero data retention, secure data retrieval, prompt defense, toxicity detection, audit, and where data masking applies.
- State whose permissions employee and service agents run with.
- Troubleshoot an agent that is missing from Setup, refuses a request, or works for some users but not others.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Editions | Enterprise, Performance, Unlimited, Developer with Foundations or Agentforce 1 | [Agent Types](https://help.salesforce.com/s/articleView?id=ai.agent_setup_explore_types.htm&language=en_US&type=5) |
| Employee agent channels | Agentforce panel in Lightning Experience, Slack, Salesforce mobile app | [Employee Agent Considerations](https://help.salesforce.com/s/articleView?id=ai.agent_employee_agent_considerations.htm&language=en_US&type=5) |
| Employee agent data access | Interacting user's permissions, sharing and field-level security | [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_layer.htm&language=en_US&type=5) |
| Service agent runs as | EinsteinServiceAgent User, Einstein Agent license and profile | [Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5) |
| Agent user default access | Minimal; expand with least privilege | [Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5) |
| Authenticated Experience Cloud customer | Agent runs as the logged-in site user | [Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5) |
| Enable prerequisite | Einstein Generative AI turned on first | [Enable Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_setup_enable.htm&language=en_US&type=5) |
| Permission to enable and build | Manage AI Agents, which grants org-wide management of all agents | [Enable Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_setup_enable.htm&language=en_US&type=5), [Agent Types](https://help.salesforce.com/s/articleView?id=ai.agent_setup_explore_types.htm&language=en_US&type=5) |
| Data masking and agents | Disabled for agents to improve performance and accuracy | [Employee Agent Considerations](https://help.salesforce.com/s/articleView?id=ai.agent_employee_agent_considerations.htm&language=en_US&type=5), [Data Masking Limitations](https://help.salesforce.com/s/articleView?id=ai.agent_trust_data_masking.htm&language=en_US&type=5) |
| Topics renamed | Called subagents from April 2026, same functionality | [Subagents](https://help.salesforce.com/s/articleView?id=ai.copilot_topics.htm&language=en_US&type=5) |

## Check yourself

- Which user record governs data access when an unauthenticated website visitor chats with a service agent? → The agent user, EinsteinServiceAgent User, through its profile, permission sets and role ([Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5))
- Why can't an agent instruction replace a validation rule for a mandatory field? → Agents act only when invoked and instructions are nondeterministic, so they can't guarantee the rule fires on every save ([Subagents](https://help.salesforce.com/s/articleView?id=ai.copilot_topics.htm&language=en_US&type=5))
- Which Einstein Trust Layer services protect an agent conversation, and which one is disabled for agents? → Zero data retention and secure data retrieval; data masking is disabled for every agent type ([Data Masking Limitations](https://help.salesforce.com/s/articleView?id=ai.agent_trust_data_masking.htm&language=en_US&type=5))
- What should you check when Agents doesn't appear in Setup after buying Agentforce? → That Einstein Generative AI is turned on; if New Agent is then missing, the permissions on your profile ([Enable Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_setup_enable.htm&language=en_US&type=5))
- Why is Manage AI Agents a sensitive permission to assign? → It grants org-wide management of every agent: activate, deactivate, and customize topics and actions ([Agent Types](https://help.salesforce.com/s/articleView?id=ai.agent_setup_explore_types.htm&language=en_US&type=5))

## Sources

- [Agent Types and Considerations](https://help.salesforce.com/s/articleView?id=ai.agent_setup_explore_types.htm&language=en_US&type=5)
- [Configure Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5)
- [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_layer.htm&language=en_US&type=5)
- [Considerations for Agentforce Employee Agent](https://help.salesforce.com/s/articleView?id=ai.agent_employee_agent_considerations.htm&language=en_US&type=5)
- [Data Masking Limitations in Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_trust_data_masking.htm&language=en_US&type=5)
- [Enable Agentforce](https://help.salesforce.com/s/articleView?id=ai.agent_setup_enable.htm&language=en_US&type=5)
- [Explore Agentforce Guardrails and Trust Patterns (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/trusted-agentic-ai/explore-agentforce-guardrails-and-trust-patterns)
- [Subagents in the Legacy Builder](https://help.salesforce.com/s/articleView?id=ai.copilot_topics.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 15 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator pack (USD $19): https://certifyforce.com/practice-exams