AgentforceExpertpcipaymentscompliance
Review agent collecting payment card data in chat against PCI scope
Real World Scenario
Pilot agent asks users to type credit card number in chat to process payment; security flags PCI scope expansion.
Expected Answer
• Never collect PAN in agent chat or logs — use payment link or tokenized iframe
• If payment action exists integrate PCI-compliant payment provider redirect
• Redact payment patterns from logs automatically
• Agent script redirects to secure payment channel on payment intent
• PCI SAQ scope assessment before any payment feature
• Train content team prohibited utterances collecting sensitive auth data
• Regular scan of conversation samples for PCI data leakage
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Never collect PAN in agent chat or logs — use payment link or tokenized iframe Also consider: If payment action exists integrate PCI-compliant payment provider redirect In practice: Redact payment patterns from logs automatically Validate against production-scale constraints and long-term platform evolution.
Architect Perspective
Chat is not PCI channel — architect payment as handoff to compliant capture always.